docs: catch up post-#658/#604/#660 + add operator hivectl section (#124)

nix/templates/harness-base.nix

@@ -249,7 +249,7 @@ in
         list_room_members, read_room) to claude via an auto-injected
         `extraMcpServers.matrix` entry. Claude spawns the stdio
         `hive-matrix-mcp` bridge per turn, which forwards each tool
-        call to the daemon over `/run/hive-matrix.sock`.
+        call to the daemon over `/run/hive-matrix/socket`.
       - wakes the agent on incoming room events via a short teaser
         Wake signal (`[matrix] <sender> in <room>: <first 100c>…`)
         to the hyperhive control socket; the full event stays
@@ -386,10 +386,11 @@ in
     description = ''
       Base URL of the hyperhive-managed Forgejo. Used at container
       boot by a oneshot systemd unit that calls
-      `tea login add --url <this> --token "$(cat /state/forge-token)"`
-      so the agent's claude can shell out to `tea` without an extra
-      auth dance. No-op when `/state/forge-token` is missing (i.e.
-      hive-forge isn't running on the host).
+      `tea login add --url <this> --token "$(cat $HYPERHIVE_STATE_DIR/forge-token)"`
+      (= `/agents/<name>/state/forge-token`) so the agent's claude can
+      shell out to `tea` without an extra auth dance. No-op when the
+      forge-token file is missing (i.e. hive-forge isn't running on
+      the host).
     '';
   };