feat(#2415): hive-priv RegisterCiRunner primitive + c0re client

Part A of moving hive-ci runner registration off the boot-critical path.
Adds a root-side hive-priv op that writes the runner registration token to
the host env-file /run/hive-ci/runner-token (in-place, preserving the inode
the container bind-mounts) and restarts the in-container gitea-runner-hive
unit. The forge admin token stays in hive-c0re; only the registration token
reaches the host env-file the container mounts read-only. The c0re-side
caller (ensure_ci_runner_registered) + the nix boot-path change land next on
this branch.

hive-priv-sock/src/lib.rs

@@ -489,6 +489,19 @@ pub enum PrivRequest {
         agent_name: String,
     },
 
+    /// Register the hive-ci Forgejo Actions runner: write the registration
+    /// token to the host-side `/run/hive-ci/runner-token` env-file (root-owned,
+    /// bind-mounted read-only into the container) as `TOKEN=<token>`, then
+    /// `systemctl --machine=hive-ci restart gitea-runner-hive.service` so the
+    /// runner picks up the credential. hive-c0re holds the forge admin token
+    /// and mints the registration token; only the registration token is written
+    /// here, and only to a host path — the admin token never enters the
+    /// container. The token is validated single-line + non-empty root-side.
+    RegisterCiRunner {
+        /// Forge runner registration token minted by hive-c0re.
+        token: String,
+    },
+
     /// Start / stop / restart a hive infrastructure container on the host
     /// via `systemctl <action> container@<container>.service`. The
     /// [`InfraContainer`] enum is the allowlist — serde rejects unknown /