fix(#2391): mandatory hive- prefixed snapshot label, nest subvol snapshot create/delete

Per mara's PR review:
- snapshot label is now mandatory (was optional w/ timestamp default)
  and must start with "hive-" — hive-priv enforces this as an
  allow-list on top of the existing credential-name charset check, so
  only hivectl-issued labels can reach the btrfs shellout.
- nest under `subvol snapshot create`/`subvol snapshot delete`
  instead of othering delete as a separate top-level `delete-snapshot`
  verb.

Per argus's review:
- regenerate docs/tools/hivectl-cli.md (hivectl markdown-docs) to
  include the new subcommands — CI's hivectl-docs-fresh check compares
  this file against generated output.

docs/tools/hivectl-cli.md

@@ -38,6 +38,9 @@ This document contains the help content for the `hivectl` command-line program.
 * [`hivectl quota limit`↴](#hivectl-quota-limit)
 * [`hivectl subvol`↴](#hivectl-subvol)
 * [`hivectl subvol upgrade`↴](#hivectl-subvol-upgrade)
+* [`hivectl subvol snapshot`↴](#hivectl-subvol-snapshot)
+* [`hivectl subvol snapshot create`↴](#hivectl-subvol-snapshot-create)
+* [`hivectl subvol snapshot delete`↴](#hivectl-subvol-snapshot-delete)
 * [`hivectl open`↴](#hivectl-open)
 * [`hivectl completions`↴](#hivectl-completions)
 
@@ -548,6 +551,7 @@ New agents get a btrfs subvolume state root automatically (when the host FS is b
 ###### **Subcommands:**
 
 * `upgrade` — Convert an existing plain-dir agent state root into a btrfs subvolume in place. Stops the agent (so its state bind-mount is released), migrates `…/agents/<name>/` to a subvolume preserving ownership/permissions/xattrs, then restarts it. Idempotent (no-op if already a subvolume) and safe (the original dir is left untouched on any failure before the final swap). Requires `--yes` since it bounces the agent and moves its state
+* `snapshot` — Read-only snapshots of an agent's state subvolume — the first step of the (in-progress) inter-hive migration path, or a manual point-in-time backup
 
 
 
@@ -567,6 +571,48 @@ Convert an existing plain-dir agent state root into a btrfs subvolume in place.
 
 
 
+## `hivectl subvol snapshot`
+
+Read-only snapshots of an agent's state subvolume — the first step of the (in-progress) inter-hive migration path, or a manual point-in-time backup
+
+**Usage:** `hivectl subvol snapshot <COMMAND>`
+
+###### **Subcommands:**
+
+* `create` — Create a read-only snapshot. Agent must already be a subvolume (`subvol upgrade` first). Prints the snapshot's host path
+* `delete` — Delete a snapshot created by `subvol snapshot create`
+
+
+
+## `hivectl subvol snapshot create`
+
+Create a read-only snapshot. Agent must already be a subvolume (`subvol upgrade` first). Prints the snapshot's host path
+
+**Usage:** `hivectl subvol snapshot create --label <LABEL> <NAME>`
+
+###### **Arguments:**
+
+* `<NAME>` — Agent name (e.g. `damocles`, `iris`)
+
+###### **Options:**
+
+* `--label <LABEL>` — Snapshot label. Mandatory, and must start with `hive-` — the prefix doubles as an allow-list hive-priv checks so only hivectl-issued snapshot names can reach the `btrfs subvolume snapshot` shellout
+
+
+
+## `hivectl subvol snapshot delete`
+
+Delete a snapshot created by `subvol snapshot create`
+
+**Usage:** `hivectl subvol snapshot delete <NAME> <LABEL>`
+
+###### **Arguments:**
+
+* `<NAME>` — Agent name the snapshot belongs to
+* `<LABEL>` — Snapshot label passed to `subvol snapshot create --label`
+
+
+
 ## `hivectl open`
 
 Print (and best-effort open in a browser) a hive web surface URL.