add a per-agent nix builds mode, host or none, carried like privateUsers

hive-priv/src/main.rs

@@ -414,6 +414,7 @@ async fn exec(
             load_credentials,
             hive_facts,
             private_users,
+            nix_builds,
         } => {
             container_config::handle_write_nspawn_flags_blocking(
                 container,
@@ -422,6 +423,7 @@ async fn exec(
                 load_credentials,
                 *hive_facts,
                 private_users,
+                nix_builds,
             )
             .await
         }