log: send records natively to journald, keep stdout off-unit

A record written to stdout carries no priority, so journald files the
whole stream at one level and the swarm log store shows `info` whatever
level `tracing` gave it. Under a systemd unit the process's stdout
already *is* the journal, so the fix is to speak the journal protocol
directly and let each record carry its own severity.

New `hive-log` crate holds the one sink chooser, called by `hive-c0re`,
`hive-agent` and `swarm-controller`. It builds the same `EnvFilter`
those binaries always built, then installs exactly one layer — never
both, since a journald layer stacked on the `fmt` layer under a unit
stores every record twice.

The choice is an fstat compare, not a presence test: a child inherits
`$JOURNAL_STREAM` even when its own stdout was redirected elsewhere, so
the variable existing proves nothing. The crate parses `dev:inode` out
of it and compares both numbers against an fstat of stdout, the
descriptor the `fmt` layer writes to by default. No match, unset, or
unparseable takes the `fmt` branch. A journald layer that fails to
construct despite a match falls back to `fmt` and warns through it —
a process must never fail to start because of its logger.

Cargo.lock

@@ -1722,6 +1722,7 @@ dependencies = [
  "hive-agent-sock",
  "hive-claude",
  "hive-core-agent-sock",
+ "hive-log",
  "hive-sh4re",
  "hive-sock-client",
  "http-body-util",
@@ -1743,7 +1744,6 @@ dependencies = [
  "tokio-stream",
  "tower-http 0.7.0",
  "tracing",
- "tracing-subscriber",
 ]
 
 [[package]]
@@ -1821,6 +1821,7 @@ dependencies = [
  "hive-host-sock",
  "hive-jobq",
  "hive-jobq-wire",
+ "hive-log",
  "hive-priv-sock",
  "hive-sh4re",
  "hive-sock-client",
@@ -1846,7 +1847,6 @@ dependencies = [
  "tokio",
  "tokio-stream",
  "tracing",
- "tracing-subscriber",
  "url",
  "utoipa",
  "utoipa-axum",
@@ -1962,6 +1962,16 @@ dependencies = [
  "utoipa",
 ]
 
+[[package]]
+name = "hive-log"
+version = "0.1.0"
+dependencies = [
+ "rustix",
+ "tracing",
+ "tracing-journald",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "hive-matrix-mcp"
 version = "0.1.0"
@@ -4886,6 +4896,7 @@ dependencies = [
  "hive-jobq",
  "hive-jobq-metrics",
  "hive-jobq-wire",
+ "hive-log",
  "hive-types",
  "hmac 0.13.0",
  "http",
@@ -4906,7 +4917,6 @@ dependencies = [
  "time",
  "tokio",
  "tracing",
- "tracing-subscriber",
  "url",
  "utoipa",
  "utoipa-axum",
@@ -5465,6 +5475,17 @@ dependencies = [
  "valuable",
 ]
 
+[[package]]
+name = "tracing-journald"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d3a81ed245bfb62592b1e2bc153e77656d94ee6a0497683a65a12ccaf2438d0"
+dependencies = [
+ "libc",
+ "tracing-core",
+ "tracing-subscriber",
+]
+
 [[package]]
 name = "tracing-log"
 version = "0.2.0"