hive: stop controlling the swarm's forge and matrix containers

The forge and matrix are swarm services; per mara's ruling on #5475
(shape a) a hive no longer starts, stops or restarts them.

- hive-priv-sock: InfraContainer keeps only Gateway; InfraTarget goes,
  service_unit maps the gateway to nginx.service directly. A
  ControlInfraContainer naming Forge/Matrix fails to decode.
- hive-host-sock: LifecycleScope drops forge/matrix and refuses unknown
  fields, so an older hivectl's --forge is an error rather than an
  all-false scope meaning everything.
- hive-c0re: scoped_infra selects only the gateway.
- hivectl: --forge/--matrix removed from stop/start/restart.
- docs: services.md says how the forge and matrix are managed;
  security.md, coordinator.md and hivectl-cli.md follow.
- hive-host-sock, hivectl/power.rs: Stop and RestartScoped doc comments name the gateway (host nginx.service), not infra containers.

docs/tools/hivectl-cli.md

@@ -514,7 +514,7 @@ Prints the nix a peer operator pastes into their swarm config to trust and reach
 
 Stop containers hive-wide in one operator action.
 
-Bare `hivectl stop` stops everything; scope flags narrow it to specific sub-agents or infra containers.
+Bare `hivectl stop` stops every agent and the gateway; scope flags narrow it to specific sub-agents or the gateway. The swarm's forge and matrix are never in scope: systemd on the services host runs them.
 
 **Usage:** `hivectl stop [OPTIONS]`
 
@@ -522,9 +522,7 @@ Bare `hivectl stop` stops everything; scope flags narrow it to specific sub-agen
 
 * `--agents` — All sub-agent containers
 * `--agent <NAME>` — A specific sub-agent by name. Repeatable: `--agent a --agent b`
-* `--forge` — The forge container (`hive-forge`)
 * `--gateway` — The gateway (`hive-gateway`) — nginx on the host, not a container
-* `--matrix` — The matrix container (`hive-matrix`)
 * `--graceful` — Gracefully quiesce each agent before stopping, instead of a hard stop. Each agent gets a graceful-stop DAG on the job queue: it signals the harness, which runs one stop-checkpoint turn to flush durable `/state` and drains, then the DAG stops the container (bounded by a 3-min timeout that falls back to a hard stop). All drains overlap. Applies to agents only
 * `--no-wait` — Return immediately after hivectl queues the stop DAGs instead of waiting for them with live per-node progress
 
@@ -534,7 +532,7 @@ Bare `hivectl stop` stops everything; scope flags narrow it to specific sub-agen
 
 Start containers hive-wide — the inverse of `hivectl stop`.
 
-Bare `hivectl start` restores the agents stopped by the last broad-scope `stop` (or starts everything if none); scope flags narrow it.
+Bare `hivectl start` restores the agents stopped by the last broad-scope `stop` (or starts everything if none); scope flags narrow it. The swarm's forge and matrix are never in scope.
 
 **Usage:** `hivectl start [OPTIONS]`
 
@@ -542,9 +540,7 @@ Bare `hivectl start` restores the agents stopped by the last broad-scope `stop`
 
 * `--agents` — All sub-agent containers
 * `--agent <NAME>` — A specific sub-agent by name. Repeatable: `--agent a --agent b`
-* `--forge` — The forge container (`hive-forge`)
 * `--gateway` — The gateway (`hive-gateway`) — nginx on the host, not a container
-* `--matrix` — The matrix container (`hive-matrix`)
 * `--no-wait` — Return immediately after hivectl queues the start DAGs instead of waiting for them with live per-node progress
 
 
@@ -553,7 +549,7 @@ Bare `hivectl start` restores the agents stopped by the last broad-scope `stop`
 
 Restart containers hive-wide — `stop` then `start` over one scope.
 
-Bare `hivectl restart` restarts everything; scope flags narrow it.
+Bare `hivectl restart` restarts everything; scope flags narrow it. The swarm's forge and matrix are never in scope.
 
 **Usage:** `hivectl restart [OPTIONS]`
 
@@ -561,9 +557,7 @@ Bare `hivectl restart` restarts everything; scope flags narrow it.
 
 * `--agents` — All sub-agent containers
 * `--agent <NAME>` — A specific sub-agent by name. Repeatable: `--agent a --agent b`
-* `--forge` — The forge container (`hive-forge`)
 * `--gateway` — The gateway (`hive-gateway`) — nginx on the host, not a container
-* `--matrix` — The matrix container (`hive-matrix`)
 * `--graceful` — Gracefully quiesce each agent on the stop half (see `stop --graceful`). Applies to agents only