mcp: remove the restart/kill/start/update/get_logs agent verbs

Container lifecycle from inside an agent goes away: an agent no longer
starts, stops, restarts or rebuilds a container in its subtree, and no
longer reads another container's journal. Those are operator actions —
the dashboard and hivectl keep their own paths to the same job-queue
and hive-priv plumbing, which is why none of that machinery is removed
here, only the five MCP verbs and what they alone reached.

What went with them: the `Request` variants and `Response::Logs` on the
agent socket, the five tool definitions and their arg structs, the four
lifecycle handlers plus `handle_get_logs`, and `require_descendant` —
the topology guard those five were the only remaining callers of.
`ToolGroup::Diagnostics` goes too: `get_logs` was its only tool, so it
would otherwise be a grantable group that grants nothing. `lifecycle`
stays, now carrying `list_containers` alone.

An agent that gets a `needs_update` or `container_crash` helper event
has no remedy of its own left, so the system prompt and the docs now
send it to the operator instead of to a tool that no longer exists.

Refs #4480

docs/turn-loop/mcp.md

@@ -20,8 +20,8 @@ for what reaches a subagent's own `--mcp-config` and what doesn't.
 
 Tool groups (`HIVE_TOOL_GROUPS`) gate tool access. The default
 preset (`AGENT_DEFAULT`) includes `messaging`, `meta`, `inbox`, and
-`execution`. Privileged groups (`lifecycle`, `approvals`, `scheduling`,
-`diagnostics`) are opt-in via the P3RM1SS10NS tab.
+`execution`. Privileged groups (`lifecycle`, `approvals`, `scheduling`)
+are opt-in via the P3RM1SS10NS tab.
 
 ## Core tools (always available)
 
@@ -135,11 +135,10 @@ hive_name?, swarm_name?, matrix_accounts? }`. `matrix_accounts` is a
 - **Subagent spawning** — headless claude sub-instances as background
   tasks, shipped default-on like bash execution (no tool group gates it
   yet). See [`docs/tools/subagent.md`](../tools/subagent.md).
-- **Lifecycle + config** (`lifecycle`, `approvals`) — manage child
-  agents, spawn new ones, apply config commits. See
+- **Lifecycle + config** (`lifecycle`, `approvals`) — list the child
+  agents in your own subtree, apply config commits. See
   [`docs/tools/lifecycle.md`](../tools/lifecycle.md).
-- **Scheduling + diagnostics** (`scheduling`, `diagnostics`) —
-  scheduled prompts, `get_logs`. See
+- **Scheduling** (`scheduling`) — scheduled prompts. See
   [`docs/tools/scheduling.md`](../tools/scheduling.md).
 - **Forge repos** (`forge`) — `create_repo` — the only agent path to
   create a repo under the `agents/` org (direct forge token creation is