mcp: remove the restart/kill/start/update/get_logs agent verbs

Container lifecycle from inside an agent goes away: an agent no longer
starts, stops, restarts or rebuilds a container in its subtree, and no
longer reads another container's journal. Those are operator actions —
the dashboard and hivectl keep their own paths to the same job-queue
and hive-priv plumbing, which is why none of that machinery is removed
here, only the five MCP verbs and what they alone reached.

What went with them: the `Request` variants and `Response::Logs` on the
agent socket, the five tool definitions and their arg structs, the four
lifecycle handlers plus `handle_get_logs`, and `require_descendant` —
the topology guard those five were the only remaining callers of.
`ToolGroup::Diagnostics` goes too: `get_logs` was its only tool, so it
would otherwise be a grantable group that grants nothing. `lifecycle`
stays, now carrying `list_containers` alone.

An agent that gets a `needs_update` or `container_crash` helper event
has no remedy of its own left, so the system prompt and the docs now
send it to the operator instead of to a tool that no longer exists.

Refs #4480

docs/tools/README.md

@@ -40,12 +40,10 @@ debug agent behavior.
 - **[forge-cli](forge-cli.md)** — the exhaustive, autogenerated
   flag-by-flag reference for `hive-forge`, kept in lockstep with the
   binary by CI the same way `hivectl-cli.md` is.
-- **[lifecycle](lifecycle.md)** — kill/start/restart/update for the
-  agents in a caller's own subtree, plus the approval-gated
-  config-change tools.
+- **[lifecycle](lifecycle.md)** — listing the agents in a caller's own
+  subtree, plus the approval-gated config-change tools.
 - **[matrix](matrix.md)** — the matrix MCP tool surface
   (`mcp__matrix__*`) for agents with a matrix account, multiple
   accounts per agent, and declaring extra MCP servers generally.
 - **[scheduling](scheduling.md)** — scheduled prompts (operator
-  approval required) and the diagnostics tools (`get_logs`,
-  `get_host_journal`).
+  approval required) and the `get_host_journal` diagnostics tool.