fix(#3245): resolve the remaining intra-doc links in hive-c0re

Takes the crate from 26 rustdoc warnings to 1, on top of the ten in the
previous commit.

argus's review findings:
- agent_sockets.rs: [`write`] was still ambiguous (function vs macro).
  The previous change narrowed the qualifier and left the ambiguity;
  [`write()`] is what resolves it.
- forge/users.rs <hex> and stats/container_stats.rs <name>: unclosed
  HTML tags in prose, now backticked.

The rest of the crate, so the count actually reaches zero:
- job_queue/mod.rs: Queue::graph_snapshot -> JobQueue::graph_snapshot
  (there is no Queue type), and super::scheduler -> scheduler (mod.rs
  *is* job_queue, so super:: pointed outside it)
- job_queue/resource.rs: NodeKind -> super::model::NodeKind
- matrix.rs: password_path(name) -> password_path; and
  forge::provision_user_token -> crate::forge::provision_user_token.
  Note the path has no `users` segment: forge/mod.rs declares `mod
  users` private and re-exports it, so the canonical path comes from the
  re-export rather than the directory tree.
- socket_server/lifecycle_handlers.rs: InfraContainer ->
  hive_priv_sock::InfraContainer
- stats/otel_metrics.rs: crate::meta::otel_config is a private fn no
  path can name from another module, so it becomes prose
- main.rs: redundant explicit link target dropped

coordinator.rs:405 (CrashWatchGuard) is deliberately untouched: #3244
deletes that doc block, so fixing it here would conflict with an open PR
and repair a symbol that is about to stop existing.

hive-c0re/src/stats/container_stats.rs

@@ -158,7 +158,7 @@ pub fn spawn_disk_sampler() {
 /// **not** create a separate machined `machine-<name>.scope` — the
 /// container's cgroup *is* the launching service unit,
 /// `container@<machine>.service`, placed under `machine.slice`.
-/// systemd-machined still logs "New machine <name>" (registration), but the
+/// systemd-machined still logs "New machine `<name>`" (registration), but the
 /// cgroup stays on the service unit. So the path is
 /// `machine.slice/container@<machine>.service`, and the service unit name is
 /// used verbatim — no `\x2d` escaping (that only applies when a string is

hive-c0re/src/stats/otel_metrics.rs

@@ -47,7 +47,7 @@ static PROVIDER: OnceLock<SdkMeterProvider> = OnceLock::new();
 
 /// Spawn the container-resource OTEL exporter if OTEL is configured
 /// (`HYPERHIVE_OTEL_ENDPOINT` non-empty — the same enable signal
-/// [`crate::meta::otel_config`] uses). No-op otherwise. Call once at startup.
+/// `meta::otel_config` uses). No-op otherwise. Call once at startup.
 pub fn spawn_exporter(hyperhive_flake: &str) {
     let Some(endpoint) = endpoint() else {
         tracing::debug!("otel container-metrics: no endpoint configured, exporter disabled");