fix(#2391): mandatory hive- prefixed snapshot label, nest subvol snapshot create/delete

Per mara's PR review:
- snapshot label is now mandatory (was optional w/ timestamp default)
  and must start with "hive-" — hive-priv enforces this as an
  allow-list on top of the existing credential-name charset check, so
  only hivectl-issued labels can reach the btrfs shellout.
- nest under `subvol snapshot create`/`subvol snapshot delete`
  instead of othering delete as a separate top-level `delete-snapshot`
  verb.

Per argus's review:
- regenerate docs/tools/hivectl-cli.md (hivectl markdown-docs) to
  include the new subcommands — CI's hivectl-docs-fresh check compares
  this file against generated output.

hive-sh4re/src/priv_proto.rs

@@ -595,8 +595,11 @@ pub enum PrivRequest {
     SnapshotAgentSubvolume {
         /// Logical agent name (validated by `validate_agent_name`).
         agent_name: String,
-        /// Snapshot label (validated like a credential name:
-        /// non-empty `[A-Za-z0-9_.-]`); becomes part of the snapshot path.
+        /// Snapshot label. Must start with `hive-` — the prefix doubles as
+        /// an allow-list hive-priv enforces so only hivectl-issued names
+        /// can reach the `btrfs subvolume snapshot` shellout — and
+        /// otherwise follows the same charset as a credential name
+        /// (non-empty `[A-Za-z0-9_.-]`); becomes part of the snapshot path.
         snapshot_name: String,
     },