hive: stop controlling the swarm's forge and matrix containers

The forge and matrix are swarm services; per mara's ruling on #5475
(shape a) a hive no longer starts, stops or restarts them.

- hive-priv-sock: InfraContainer keeps only Gateway; InfraTarget goes,
  service_unit maps the gateway to nginx.service directly. A
  ControlInfraContainer naming Forge/Matrix fails to decode.
- hive-host-sock: LifecycleScope drops forge/matrix and refuses unknown
  fields, so an older hivectl's --forge is an error rather than an
  all-false scope meaning everything.
- hive-c0re: scoped_infra selects only the gateway.
- hivectl: --forge/--matrix removed from stop/start/restart.
- docs: services.md says how the forge and matrix are managed;
  security.md, coordinator.md and hivectl-cli.md follow.
- hive-host-sock, hivectl/power.rs: Stop and RestartScoped doc comments name the gateway (host nginx.service), not infra containers.

hivectl/src/cli.rs

@@ -99,8 +99,10 @@ pub enum Cmd {
     },
     /// Stop containers hive-wide in one operator action.
     ///
-    /// Bare `hivectl stop` stops everything; scope flags narrow it to
-    /// specific sub-agents or infra containers.
+    /// Bare `hivectl stop` stops every agent and the gateway; scope flags
+    /// narrow it to specific sub-agents or the gateway. The swarm's forge
+    /// and matrix are never in scope: systemd on the services host runs
+    /// them.
     Stop {
         #[command(flatten)]
         scope: ScopeArgs,
@@ -121,7 +123,7 @@ pub enum Cmd {
     ///
     /// Bare `hivectl start` restores the agents stopped by the last
     /// broad-scope `stop` (or starts everything if none); scope flags
-    /// narrow it.
+    /// narrow it. The swarm's forge and matrix are never in scope.
     Start {
         #[command(flatten)]
         scope: ScopeArgs,
@@ -133,6 +135,7 @@ pub enum Cmd {
     /// Restart containers hive-wide — `stop` then `start` over one scope.
     ///
     /// Bare `hivectl restart` restarts everything; scope flags narrow it.
+    /// The swarm's forge and matrix are never in scope.
     Restart {
         #[command(flatten)]
         scope: ScopeArgs,
@@ -179,14 +182,10 @@ pub enum OpenTarget {
     Matrix,
 }
 
-/// Shared scope flags for `hivectl stop` / `hivectl start`. With no flag
-/// set the verb targets **everything** (all sub-agents + every controllable
-/// infra container). Setting any flag restricts to the selected classes,
+/// Shared scope flags for `hivectl stop` / `start` / `restart`. With no
+/// flag set the verb targets **everything** (all sub-agents + the
+/// gateway). Setting any flag restricts to the selected classes,
 /// additively.
-// One bool per selectable container class, each mapping 1:1 to a clap flag;
-// orthogonal toggles, not a state machine — hence the bools allow (mirrors
-// `hive_host_sock::LifecycleScope`).
-#[allow(clippy::struct_excessive_bools)]
 #[derive(Args)]
 pub struct ScopeArgs {
     /// All sub-agent containers.
@@ -195,15 +194,9 @@ pub struct ScopeArgs {
     /// A specific sub-agent by name. Repeatable: `--agent a --agent b`.
     #[arg(long = "agent", value_name = "NAME")]
     agent: Vec<String>,
-    /// The forge container (`hive-forge`).
-    #[arg(long)]
-    forge: bool,
     /// The gateway (`hive-gateway`) — nginx on the host, not a container.
     #[arg(long)]
     gateway: bool,
-    /// The matrix container (`hive-matrix`).
-    #[arg(long)]
-    matrix: bool,
 }
 
 impl ScopeArgs {
@@ -211,9 +204,7 @@ impl ScopeArgs {
         hive_host_sock::LifecycleScope {
             agents: self.agents,
             agent_names: self.agent.clone(),
-            forge: self.forge,
             gateway: self.gateway,
-            matrix: self.matrix,
         }
     }
 }

hivectl/src/power.rs

@@ -45,7 +45,7 @@ pub(crate) async fn start(
 /// issue tracker "dagify hivectl commands"). Each targeted agent rides
 /// exactly one atomic DAG queued up front — `Restart` (mechanical stop +
 /// reconcile), or `GracefulRestart` with `--graceful` (signal → drain →
-/// mechanical stop → reconcile); infra containers restart synchronously.
+/// mechanical stop → reconcile); the gateway (host `nginx.service`) restarts synchronously.
 /// No "submit one DAG, wait for it, submit another" composition on either
 /// side of the wire: unlike the old client-side stop-then-start compose, a
 /// dropped `hivectl` connection mid-restart no longer leaves an agent

hivectl/src/subvol.rs

@@ -16,9 +16,7 @@ fn single_agent_scope(name: &str) -> hive_host_sock::LifecycleScope {
     hive_host_sock::LifecycleScope {
         agents: false,
         agent_names: vec![name.to_owned()],
-        forge: false,
         gateway: false,
-        matrix: false,
     }
 }