fix(#2639): cancel_loose_end kind="todo" clears without a bash round-trip

Adds a real MCP-side path for the workaround #2639 documented: dial the
in-container HIVE_AGENT_SOCKET directly from cancel_loose_end (kind:"todo")
instead of shelling out via a tracked bash task (nc -U ...), which is what
was spawning a fresh completion todo on every clear and cascading forever.

hive-agent-mcp/src/mcp/render.rs: renamed local_todos's socket-dial guts
into a shared dial_agent_socket(req) helper, added mark_local_todo_done(id)
on top of it (MarkTodoDone request already existed server-side, unused
until now). mod.rs wires kind:"todo" into cancel_loose_end ahead of the
question/reminder/approval parse. args.rs + render.rs + docs/tools/bash.md
text updated to point at the new path instead of the old raw nc invocation.

docs/tools/bash.md

@@ -114,9 +114,11 @@ todo (`key = task id`) on the harness's in-agent socket (`HIVE_AGENT_SOCKET`)
 — "running" at start, then the completion summary when it finishes. The
 summary change signals the harness turn loop directly (in-process, no broker
 round-trip), so the agent is driven a turn to handle it via `get_loose_ends`,
-then clears the todo with `mark_todo_done`. Same mechanism the matrix daemon
-uses for unread rooms. An inline `wait_seconds` / `status` observation that
-already delivered the result instead clears the keyed todo, so no redundant
+then clears the todo with `cancel_loose_end(kind: "todo", id: N)` (dials the
+in-container socket directly — no bash task involved, so clearing doesn't
+spawn another todo; see #2639). Same mechanism the matrix daemon uses for
+unread rooms. An inline `wait_seconds` / `status` observation that already
+delivered the result instead clears the keyed todo, so no redundant
 loose-end follows.
 
 ## Relationship to the `execution` tool group