hivectl: add hive-wide start/stop verbs

`hivectl stop` brings the whole hive down in one operator action — all
sub-agents plus the ci/forge/gateway/matrix infra containers — and
`hivectl start` brings it back up. Scope flags (--agents, --agent <name>,
--ci, --forge, --gateway, --matrix) narrow the set; a bare invocation
targets everything. hive-c0re never stops itself.

- hive-sh4re: HostRequest::{Stop,Start} + LifecycleScope wire type;
  priv_proto InfraAction + ControlInfraContainer + the
  CONTROLLABLE_INFRA_CONTAINERS allowlist (adds hive-matrix, excludes
  hive-c0re).
- hive-priv: control_infra_container handler (systemctl <verb>
  container@<name>, allowlist-validated root-side).
- hive-c0re: handle_stop / handle_start fan out agents via lifecycle and
  infra via hive-priv; per-target failures are aggregated. Infra
  systemctl routes through hive-priv (the privsep boundary).
- The --graceful flag is threaded through Stop now; the per-agent quiesce
  itself lands with the graceful-agent-stop work.

hive-c0re/src/priv_client.rs

@@ -8,8 +8,8 @@
 
 use anyhow::{Context as _, Result, bail};
 use hive_sh4re::priv_proto::{
-    BindMount, JournalQuery, NetworkIsolation, PRIV_SOCK, PrivEvent, PrivRequest, PrivResponse,
-    PrivStream,
+    BindMount, InfraAction, JournalQuery, NetworkIsolation, PRIV_SOCK, PrivEvent, PrivRequest,
+    PrivResponse, PrivStream,
 };
 use tokio::io::{AsyncBufReadExt, AsyncWriteExt, BufReader};
 use tokio::net::UnixStream;
@@ -295,6 +295,20 @@ pub async fn restart_infra_container(container: &str) -> Result<()> {
     .await?)
 }
 
+/// Start / stop / restart a hive infrastructure container (`hive-ci`,
+/// `hive-gateway`, `hive-forge`, `hive-matrix`) on the host via `systemctl
+/// <action> container@<container>.service`. hive-priv re-validates
+/// `container` against its root-side allowlist
+/// (`CONTROLLABLE_INFRA_CONTAINERS`). Used by the hive-wide `hivectl stop` /
+/// `hivectl start` flow.
+pub async fn control_infra_container(container: &str, action: InfraAction) -> Result<()> {
+    ok(call(&PrivRequest::ControlInfraContainer {
+        container: container.to_owned(),
+        action,
+    })
+    .await?)
+}
+
 fn check(resp: PrivResponse) -> Result<(String, String)> {
     if resp.ok {
         Ok((resp.stdout, resp.stderr))