hive-c0re: polish subvol-upgrade error paths (post-merge review follow-up)

Two non-blocking points from the subvol-upgrade review:

- The start request was `?`-propagated before the migration result was
  surfaced, so a restart-side failure (incl. the IPC call itself
  erroring) could shadow whether the migration succeeded or failed.
  Capture the start result instead and surface the migration outcome
  first; the restart-failure messages now point at `hivectl start
  --agent <name>` for manual recovery.

- The crash-window case (host dies between the two swap renames, leaving
  the agent root missing but the original data under `.<name>.old`) now
  detects the leftover and tells the operator to `mv` it back, instead
  of a bare "no state dir to upgrade — nothing to do".

hive-priv/src/main.rs

@@ -797,6 +797,21 @@ async fn upgrade_agent_subvolume(agent_name: &str) -> Result<(String, String)> {
     let agent_root = root.join(agent_name);
 
     if !agent_root.exists() {
+        // A crash between the two swap renames (original → `.<name>.old`
+        // succeeded, `.<name>.migrating` → agent_root did not) leaves the
+        // agent root missing but the original data intact under `.<name>.old`.
+        // Point at the recovery rather than a bare "nothing to do" so the
+        // operator isn't left guessing where the data went.
+        let old = root.join(format!(".{agent_name}.old"));
+        if old.exists() {
+            bail!(
+                "no state dir at {agent} — but {old} holds the original data from an \
+                 interrupted upgrade (host crashed mid-swap). Restore it with \
+                 `mv {old} {agent}`, then re-run the upgrade.",
+                agent = agent_root.display(),
+                old = old.display(),
+            );
+        }
         bail!(
             "no state dir to upgrade at {} — nothing to do",
             agent_root.display()