docs: catch up post-#658/#604/#660 + add operator hivectl section (#124)

README.md

@@ -195,6 +195,24 @@ the container as environment variables. Common options:
 See `nix/templates/harness-base.nix` for the full list of options and
 their descriptions.
 
+## Operator CLI
+
+`hivectl` is the operator-facing host CLI for ad-hoc administration that
+doesn't go through the broker (built alongside `hive-c0re` when the host
+module is enabled):
+
+```sh
+sudo hivectl forge create-user mara              # provisions a forge user
+sudo hivectl forge create-user mara --password   # … with a fixed password
+sudo hivectl matrix create-user mara             # provisions a matrix user
+sudo hivectl matrix create-user mara --password-stdin   # … reading from stdin
+```
+
+For agent names (i.e., a `Coordinator::agent_state_root(name)` exists),
+`hivectl` persists the resulting token to the agent's state dir like the
+boot sweep does. For non-agent names (e.g. the operator's own forge/matrix
+account), it prints the token to stdout and writes nothing.
+
 ## Build / deploy
 
 ```sh