refactor(#2431): extract hive-priv-sock crate from hive-sh4re

Split the priv-socket wire types (PrivRequest/PrivResponse/PrivEvent and
friends) out of hive-sh4re into their own hive-priv-sock crate, mirroring
the existing hive-host-sock split. hive-priv — the root-privileged
helper — now depends on just this narrow protocol crate instead of the
much larger daemon-shared crate, shrinking its dependency surface and
making the privsep boundary easier to audit. No server/client
implementation lives here, only the wire contract; hive-c0re still
depends on hive-sh4re directly for everything else.

hive-c0re/src/lifecycle/host_config.rs

@@ -5,7 +5,7 @@
 use std::path::Path;
 
 use anyhow::{Context, Result};
-use hive_sh4re::priv_proto::{BindMount, CredentialMount};
+use hive_priv_sock::{BindMount, CredentialMount};
 
 use crate::coordinator::{AgentPaths, HiveEnv};
 
@@ -313,7 +313,7 @@ async fn set_nspawn_flags(
                 %agent_name, %gateway_ip, %bridge,
                 "network isolation: PRIVATE_NETWORK=1 (DHCP)"
             );
-            Some(hive_sh4re::priv_proto::NetworkIsolation { bridge, gateway_ip })
+            Some(hive_priv_sock::NetworkIsolation { bridge, gateway_ip })
         } else {
             None
         }