refactor(#2431): extract hive-priv-sock crate from hive-sh4re

Split the priv-socket wire types (PrivRequest/PrivResponse/PrivEvent and
friends) out of hive-sh4re into their own hive-priv-sock crate, mirroring
the existing hive-host-sock split. hive-priv — the root-privileged
helper — now depends on just this narrow protocol crate instead of the
much larger daemon-shared crate, shrinking its dependency surface and
making the privsep boundary easier to audit. No server/client
implementation lives here, only the wire contract; hive-c0re still
depends on hive-sh4re directly for everything else.

Cargo.lock

@@ -1520,6 +1520,7 @@ dependencies = [
  "clap_complete",
  "forgejo-api",
  "hive-host-sock",
+ "hive-priv-sock",
  "hive-sh4re",
  "hmac",
  "indicatif",
@@ -1609,7 +1610,7 @@ name = "hive-priv"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "hive-sh4re",
+ "hive-priv-sock",
  "libc",
  "serde_json",
  "tokio",
@@ -1617,6 +1618,13 @@ dependencies = [
  "tracing-subscriber",
 ]
 
+[[package]]
+name = "hive-priv-sock"
+version = "0.1.0"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "hive-sh4re"
 version = "0.1.0"