feat(#1636): infra_admin capability — restart hive-ci/gateway/forge via restart tool

hive-c0re/src/priv_client.rs

@@ -276,6 +276,18 @@ pub async fn restart_matrix_daemon(agent_name: &str) -> Result<()> {
     .await?)
 }
 
+/// Restart a hive infrastructure container (hive-ci / hive-gateway /
+/// hive-forge) on the host via `systemctl restart
+/// container@<container>.service`. hive-priv re-validates `container`
+/// against its root-side allowlist; callers must already have checked
+/// the requesting agent holds the `infra_admin` capability.
+pub async fn restart_infra_container(container: &str) -> Result<()> {
+    ok(call(&PrivRequest::RestartInfraContainer {
+        container: container.to_owned(),
+    })
+    .await?)
+}
+
 fn check(resp: PrivResponse) -> Result<(String, String)> {
     if resp.ok {
         Ok((resp.stdout, resp.stderr))