matrix: scope the daemon's token watcher to this agent's own state dir

`hive-matrix-daemon.path` globbed `/agents/*/state/matrix-token*`. Every
agent's state dir is visible from inside every container, so the
condition is satisfied by a sibling's token.

That is reachable, not cosmetic. The daemon deliberately exits 0 when it
has no token of its own — `Restart = "on-failure"` therefore does not
restart it, and the unit sits inactive, which is the state the path unit
exists for. In that state a sibling's token keeps the glob satisfied:
the path fires, the daemon exits 0, the unit deactivates, the path
re-arms, the condition is still true. systemd.path(5) activates a
`PathExists`-family condition that already holds immediately on arming,
so it repeats until the start limit stops it.

Scoped to this agent, the condition is false exactly when the daemon
would have nothing to do.

The glob is quoted in four other places, all of which would otherwise
name a pattern that no longer exists — a doc, a Rust doc-comment in
hive-c0re, a nix comment, and an assertion message an operator reads.
Each is reworded to the basename (`matrix-token*` in this agent's state
dir), which is what the assertion actually enforces via `baseNameOf`, so
they stay true wherever the directory moves.

Refs #4030.

hive-c0re/src/workers/credential.rs

@@ -5,8 +5,9 @@
 //! account; this reads the value out of the store and writes it where the
 //! agent's matrix daemon already watches for it. Nothing here activates
 //! anything: `nix/agent-modules/matrix.nix` has a `systemd.paths` unit
-//! globbing `/agents/*/state/matrix-token*` that re-fires the daemon when a
-//! token appears, so arrival is the whole trigger.
+//! globbing `matrix-token*` inside that agent's own state dir, which
+//! re-fires the daemon when a token appears, so arrival is the whole
+//! trigger.
 //!
 //! 🔑 The notice carries no secret — see [`swarm_queue_client::credential_subject`]
 //! for why that is a requirement rather than a preference. The value is read