feat(swarm-controller): new crate, a unix-socket listener and nothing else

First half of the swarm-controller slice: the crate, its workspace entry
and its daemonBins entry, so the systemd unit that follows has a binary
to point at.

It serves one health endpoint and owns no state. That is the whole
intent -- this makes the unit real (service user, runtime and state
directories, socket, nginx reachability) so the swarm-level surfaces
that follow have somewhere to land. Inventing those surfaces now would
bake in a shape nobody has agreed to.

The socket gets its own runtime directory rather than sharing
hive-c0re's. nginx reaches a unix upstream by having the socket's
directory bind-mounted into the gateway container, so co-locating this
socket with the host admin socket would hand the gateway that socket
too.

Cargo.toml

@@ -21,6 +21,7 @@ members = [
   "hive-sock-client",
   "hive-types",
   "hivectl",
+  "swarm-controller",
 ]
 
 [workspace.package]