hive-subagent-mcp: check subagent models against the swarm's subagent_models

A `start` or `continue` naming a `model` now reads this agent's key in the
`agent-inference` bucket and, when `subagent_models` is set, checks the
model against that list instead of HIVE_AVAILABLE_MODELS (agent.nix
`availableModels`). An unset field, an absent key or an absent bucket
keeps today's check. A read that fails or takes over 2 s falls back to
HIVE_AVAILABLE_MODELS with a warning, so a subagent start never waits on
the queue. A call without a `model` is not checked and does not read.

The read uses the agent's own queue credential through swarm_term's
connect, and the one direct-get subject the agent is granted in that
bucket. The refusal names the list and that it came from the swarm.

Refs #5034 (S5)

hive-subagent-mcp/src/swarm_term.rs

@@ -149,9 +149,9 @@ impl Publisher {
 }
 
 /// Where to publish, and what to connect with.
-struct Target {
-    url: String,
-    agent: String,
+pub(crate) struct Target {
+    pub(crate) url: String,
+    pub(crate) agent: String,
     store: StoreSource,
 }
 
@@ -168,7 +168,9 @@ impl Target {
     ///
     /// # Errors
     /// A store address without the agent name or the identity beside it.
-    fn from_lookup(get: impl Fn(&str) -> Option<String>) -> anyhow::Result<Option<Self>> {
+    pub(crate) fn from_lookup(
+        get: impl Fn(&str) -> Option<String>,
+    ) -> anyhow::Result<Option<Self>> {
         let Some(url) = get(ENV_NATS_URL).filter(|v| !v.is_empty()) else {
             return Ok(None);
         };
@@ -225,7 +227,7 @@ impl StoreSource {
 
 /// Connect presenting the agent's own token, read from the store on every
 /// connection attempt so a re-minted secret is picked up on reconnect.
-async fn connect(target: &Arc<Target>) -> anyhow::Result<async_nats::Client> {
+pub(crate) async fn connect(target: &Arc<Target>) -> anyhow::Result<async_nats::Client> {
     let url = target.url.clone();
     let target = Arc::clone(target);
     let agent = target.agent.clone();