move agent_token from swarm-queue-client to swarm-agent-verify

per #5471, verifiers stop depending on the queue client. the module is
store-free and needs only thiserror, so swarm-agent-verify gains one
dependency and loses its swarm-queue-client edge. consumers import it
from swarm_agent_verify; swarm-logs and swarm-metrics, whose only use of
swarm-queue-client was this module, drop that dependency, as does
swarm-logs-auth.

hive-subagent-mcp/Cargo.toml

@@ -34,6 +34,8 @@ swarm-queue-client = { workspace = true, features = [
   "agent-inference",
   "agent-permissions",
 ] }
+# The spelling of the token the queue connection presents.
+swarm-agent-verify.workspace = true
 # The agent's own queue credential, read under its store identity.
 swarm-secret-client.workspace = true
 tokio.workspace = true

hive-subagent-mcp/src/swarm_term.rs

@@ -237,7 +237,7 @@ pub(crate) async fn connect(target: &Arc<Target>) -> anyhow::Result<async_nats::
         // `Sync` as async-nats's auth callback requires; the store read is not.
         let attempt = tokio::spawn(async move {
             let value = target.store.read().await.map_err(|e| format!("{e:#}"))?;
-            swarm_queue_client::agent_token::format_agent_token(&target.agent, &value)
+            swarm_agent_verify::agent_token::format_agent_token(&target.agent, &value)
                 .map_err(|e| e.to_string())
         });
         async move { attempt.await.map_err(|e| e.to_string())? }