feat: socket-activate the hive-c0re admin socket

Add a systemd.sockets.hive-c0re unit that holds /run/hyperhive/host.sock
before hive-c0re starts. hive-c0re serve() detects LISTEN_FDS via the
listenfd crate and accepts the systemd-handed fd instead of calling bind().
Falls back to the existing bind path when LISTEN_FDS is absent so direct
invocation and CI are unaffected.

Benefits: hivectl can connect the moment the socket unit activates (no
racy window), and a hive-c0re restart never drops the socket inode.

nix/modules/hive-c0re.nix

@@ -370,5 +370,31 @@ in
         StateDirectory = "hyperhive";
       };
     };
+
+    # Socket unit for the hive-c0re admin socket. systemd creates and holds
+    # `/run/hyperhive/host.sock` before hive-c0re starts, then passes the fd
+    # via LISTEN_FDS (socket activation). Benefits: `hivectl` can connect
+    # the moment the socket unit is active — no racy retry window — and a
+    # hive-c0re restart never drops the socket inode, so queued commands
+    # drain cleanly.
+    #
+    # `hive-c0re serve` reads LISTEN_FDS via the `listenfd` crate and
+    # accepts the fd in preference to its own `bind()` path. When invoked
+    # directly (dev, CI, without the socket unit) LISTEN_FDS is absent and
+    # the traditional bind path runs unchanged — no regression.
+    systemd.sockets.hive-c0re = {
+      description = "hive-c0re admin socket";
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        # Must match the `--socket` arg passed to `hive-c0re serve`.
+        ListenStream = "/run/hyperhive/host.sock";
+        # 0660 root:root — `hivectl` is a host-only tool run as root.
+        SocketMode = "0660";
+        # Parent dir inherits the RuntimeDirectory mode (0750) set on the
+        # service unit; DirectoryMode is only consulted when the dir is
+        # absent at socket-unit activation.
+        DirectoryMode = "0750";
+      };
+    };
   };
 }