take the agent-create and forge-token responses from swarm-controller-api

swarmctl decoded POST /api/agents and POST /api/agents/{name}/forge-token
into hand-written copies of the controller's private response structs.
Both now live in swarm-controller-api, so a field renamed on one side is a
compile error on the other. Wire format and OpenAPI schema are unchanged.

The request side stays mirrored: CreateAgentRequest carries inference
settings and an ArchetypeRef (swarm-queue-client types) and Permission
(hive-sh4re), and the permissions body is a list of Permission. Where
those types live is #5471's decision.

Files:
- swarm-controller-api/src/agents.rs, lib.rs: the two responses, with
  round-trip tests whose literals come from the tests that move here.
- swarm-controller/src/main.rs: imports them; the struct definitions and
  create_agent_warning_tests (now in the api crate) go.
- swarmctl/src/agent.rs: imports them; the mirrors and their decode tests
  go, and the module doc says only the request is mirrored now.
- swarmctl/src/permissions.rs: its doc pointed at agent.rs for why it
  mirrors; that reason no longer covers Permissions, so it gives its own.
- swarmctl/README.md, swarm-controller-api/README.md, CLAUDE.md: which
  bodies are shared and which are mirrored.

Part of #5472

swarmctl/src/permissions.rs

@@ -5,9 +5,10 @@
 //! it restarts it, after its current turn, when `manage_root_agent` changes.
 //! Unset leaves the agent on the default set; an empty list grants nothing.
 //!
-//! The shape below mirrors the controller's `Permissions`, for the reason
-//! [`crate::agent`]'s module doc gives. Permission names are checked by the
-//! controller, which answers 422 for one it does not know.
+//! The shape below mirrors the controller's `Permissions`, whose names are
+//! `hive_sh4re::permissions::Permission`, and `swarm-controller-api` does not
+//! depend on `hive-sh4re`. Permission names are checked by the controller,
+//! which answers 422 for one it does not know.
 
 use anyhow::{Context as _, Result};
 use serde::{Deserialize, Serialize};