hivectl: add agent <name> watch to follow live events from the CLI

hive-c0re/src/paths.rs

@@ -41,11 +41,6 @@ pub const STATE_ROOT: &str = "/var/lib/hyperhive";
 //        stay in sync; the privsep boundary prevents importing across the crate.
 pub const RUNTIME_ROOT: &str = "/run/hyperhive";
 
-/// `/run/hive-agent` — per-agent runtime socket dir root (web + bound
-/// markers), one subdir per agent.
-// nix: agent container bind-mount / `RuntimeDirectory` (the harness nix modules) — must match.
-pub const AGENT_SOCKET_DIR: &str = "/run/hive-agent";
-
 /// Default broker db path (`db/broker.sqlite`). Exposed as a `&str` for
 /// the `--broker-db` clap `default_value`; `build_logs.sqlite` is placed
 /// alongside it (the build-logs store keys off the broker db's parent).

hive-c0re/src/workers/agent_sockets.rs

@@ -17,9 +17,10 @@ use anyhow::{Context, Result};
 /// gateway container bind-mounts this whole tree (read-only) so it
 /// can `proxy_pass` to any agent. Each agent's container bind-mounts
 /// only its own `<name>/` subdir — agents can only access their own
-/// sockets. The literal lives in [`crate::paths`]; re-exported here
-/// under the name this module's consumers have always used.
-pub use crate::paths::AGENT_SOCKET_DIR;
+/// sockets. The literal lives in `hive-host-sock` (shared with
+/// `hivectl`); re-exported here under the name this module's consumers
+/// have always used.
+pub use hive_host_sock::AGENT_SOCKET_DIR;
 
 /// Socket filename inside each per-agent subdir. Fixed so the path
 /// derives entirely from `(AGENT_SOCKET_DIR, name)` — no second