feat(#1636): infra_admin capability — restart hive-ci/gateway/forge via restart tool

hive-sh4re/src/lib.rs

@@ -1031,6 +1031,13 @@ pub enum Capability {
     /// available on the agent socket even with this capability — use the
     /// manager socket for swarm-wide scans.
     QueryAgentState,
+    /// Agent can restart hive infrastructure containers (hive-ci,
+    /// hive-gateway, hive-forge) via the `restart` MCP tool. hive-c0re
+    /// checks this capability before routing the restart through
+    /// hive-priv; the concrete service allowlist lives root-side in
+    /// hive-priv. Deliberately generic ("infra admin") so future
+    /// privileged infra ops can hang off the same grant.
+    InfraAdmin,
 }
 
 impl Capability {
@@ -1040,6 +1047,7 @@ impl Capability {
         Self::ManageRootAgent,
         Self::ReadHostJournal,
         Self::QueryAgentState,
+        Self::InfraAdmin,
     ];
 
     /// Canonical `snake_case` name for this capability (matches serde).
@@ -1049,6 +1057,7 @@ impl Capability {
             Self::ManageRootAgent => "manage_root_agent",
             Self::ReadHostJournal => "read_host_journal",
             Self::QueryAgentState => "query_agent_state",
+            Self::InfraAdmin => "infra_admin",
         }
     }
 
@@ -1063,6 +1072,9 @@ impl Capability {
             Self::QueryAgentState => {
                 "query non-child agents' loose ends and reminder state via get_loose_ends"
             }
+            Self::InfraAdmin => {
+                "restart hive infrastructure containers (hive-ci, hive-gateway, hive-forge) via the restart tool"
+            }
         }
     }
 }