take the agent-create and forge-token responses from swarm-controller-api

swarmctl decoded POST /api/agents and POST /api/agents/{name}/forge-token
into hand-written copies of the controller's private response structs.
Both now live in swarm-controller-api, so a field renamed on one side is a
compile error on the other. Wire format and OpenAPI schema are unchanged.

The request side stays mirrored: CreateAgentRequest carries inference
settings and an ArchetypeRef (swarm-queue-client types) and Permission
(hive-sh4re), and the permissions body is a list of Permission. Where
those types live is #5471's decision.

Files:
- swarm-controller-api/src/agents.rs, lib.rs: the two responses, with
  round-trip tests whose literals come from the tests that move here.
- swarm-controller/src/main.rs: imports them; the struct definitions and
  create_agent_warning_tests (now in the api crate) go.
- swarmctl/src/agent.rs: imports them; the mirrors and their decode tests
  go, and the module doc says only the request is mirrored now.
- swarmctl/src/permissions.rs: its doc pointed at agent.rs for why it
  mirrors; that reason no longer covers Permissions, so it gives its own.
- swarmctl/README.md, swarm-controller-api/README.md, CLAUDE.md: which
  bodies are shared and which are mirrored.

Part of #5472

swarmctl/README.md

@@ -8,8 +8,8 @@ that talk to the controller, from anywhere as your own SSO account (see
 Distinct from `hivectl`, which drives one hive's `hive-c0re` over its
 admin socket. This crate doesn't link `swarm-controller`, for the same
 reason `hivectl` doesn't link `hive-c0re`; the forge and schedule bodies
-both sides speak come from `swarm-controller-api`, as `hivectl`'s come from
-`hive-host-sock`.
+and the agent responses both sides speak come from `swarm-controller-api`,
+as `hivectl`'s come from `hive-host-sock`.
 
 ## Why root, and why no socket
 
@@ -118,11 +118,11 @@ domain's SSO gate.
 controller checks it against the swarm's hive roster and names the hives
 that would have worked when it misses.
 
-The request and response shapes are mirrored in `src/agent.rs` rather
-than shared: the controller's own types are private to its binary, this
-crate does not link it, and there is no wire-type crate between them.
-Two fields out, two in, both ends validating — a drift shows up as a
-400 naming the field.
+The response shapes come from `swarm-controller-api`. `src/agent.rs`
+mirrors the request shape: the controller's `CreateAgentRequest`
+carries types from `swarm-queue-client` and `hive-sh4re`, neither of
+which `swarm-controller-api` depends on. Two fields out, both ends
+validating — a drift shows up as a 400 naming the field.
 
 ## `agent mint-forge-token`