docs: the trust-boundary pages keep the operator guidance, the mechanism moves to implementation

boundary.md keeps the model, the design rule, why network isolation
matters and host admin socket access; the hive-priv socket activation and
the per-agent socket directory move to 4-implementation/trust-boundary.
security.md keeps the agent trust model and the path-name rule; the nix
builds mode with its threat model, and the hive-c0re privilege separation,
move to their own pages there. Headings and text move as they were, with
one level shaved off the heading depth. Links, code and nix pointers, and
the docs index follow the moves.

nix/agent-modules/default.nix

@@ -200,7 +200,7 @@ in
     # in-container `nix build` invocations fall back to unsandboxed
     # local builds rather than failing on the missing user-namespace.
     # See `docs/5-project/process/gotchas.md::Containerized nix-daemon needs
-    # sandbox-fallback = true` + `docs/2-handbook/trust-boundary/security.md` for the rationale.
+    # sandbox-fallback = true` + `docs/4-implementation/trust-boundary/nix-builds.md` for the rationale.
     #
     # Note: with NIX_REMOTE=daemon below this becomes a no-op for the
     # common case — daemon-routed builds run on the host where sandboxing

nix/agent-modules/user.nix

@@ -290,7 +290,7 @@ in
       # The socket dir is bind-mounted from the host, where hive-priv creates
       # it `0751 root`. The harness binds its sockets here as this user; the
       # 0751 is what lets hive-c0re and nginx dial them without listing
-      # (docs/2-handbook/trust-boundary/boundary.md, "the per-agent socket dir"). Not
+      # (docs/4-implementation/trust-boundary/boundary-mechanism.md, "the per-agent socket dir"). Not
       # recursive: only the harness writes inside it. `test -d` and `chmod`
       # follow symlinks, so a link here is refused rather than handed over.
       socketDir="/run/hive-agent/$userName"