The forge and matrix containers belong to the services host, not to a
hive. hive-priv's container-name validator still accepted hive-forge and
hive-matrix for WriteNspawnFlags, WriteResourceLimits and
RemoveServiceDropin; hive-c0re only ever sends h-<agent> names there.
- hive-priv-sock/src/lib.rs: drop SIBLING_CONTAINERS, its only user was
the validator, and its test.
- hive-priv/src/main.rs: the validator accepts only h-<name> and returns
the logical name, so write_resource_limits loses its non-h- fallback;
test that all three requests refuse both names.
- hive-priv/README.md, docs/trust-boundary/security.md: the allowlist
no longer lists the forge and matrix.
Fixes#5508
4f75e2a71a