refactor(#2431): extract hive-priv-sock crate from hive-sh4re

Split the priv-socket wire types (PrivRequest/PrivResponse/PrivEvent and
friends) out of hive-sh4re into their own hive-priv-sock crate, mirroring
the existing hive-host-sock split. hive-priv — the root-privileged
helper — now depends on just this narrow protocol crate instead of the
much larger daemon-shared crate, shrinking its dependency surface and
making the privsep boundary easier to audit. No server/client
implementation lives here, only the wire contract; hive-c0re still
depends on hive-sh4re directly for everything else.

hive-c0re/src/dashboard/infra_containers.rs

@@ -10,7 +10,7 @@ use axum::{
     http::StatusCode,
     response::{IntoResponse, Response},
 };
-use hive_sh4re::priv_proto::{InfraAction, InfraContainer};
+use hive_priv_sock::{InfraAction, InfraContainer};
 
 use super::{AppState, error_response};
 

hive-c0re/src/dashboard/journal.rs

@@ -74,10 +74,10 @@ pub(super) async fn get_journal(
     };
     match crate::priv_client::read_container_journal(
         &prefixed,
-        hive_sh4re::priv_proto::JournalQuery {
+        hive_priv_sock::JournalQuery {
             lines,
             boot: true,
-            output: hive_sh4re::priv_proto::JournalOutput::ShortIso,
+            output: hive_priv_sock::JournalOutput::ShortIso,
             unit,
             ..Default::default()
         },

hive-c0re/src/dashboard/state_snapshot.rs

@@ -145,9 +145,8 @@ struct InfraContainerView {
 /// Extracted out of [`api_state`] to keep it under clippy's
 /// `too_many_lines` limit.
 async fn infra_container_views() -> Vec<InfraContainerView> {
-    let mut infra_containers =
-        Vec::with_capacity(hive_sh4re::priv_proto::InfraContainer::ALL.len());
-    for container in hive_sh4re::priv_proto::InfraContainer::ALL {
+    let mut infra_containers = Vec::with_capacity(hive_priv_sock::InfraContainer::ALL.len());
+    for container in hive_priv_sock::InfraContainer::ALL {
         infra_containers.push(InfraContainerView {
             name: container.unit_name(),
             running: crate::lifecycle::infra_is_running(container).await,