add a per-agent nix builds mode, host or none, carried like privateUsers

nix/agent-modules/default.nix

@@ -135,6 +135,32 @@ in
     '';
   };
 
+  options.services.hyperhive.agent.nixBuilds = lib.mkOption {
+    type = lib.types.enum [
+      "host"
+      "none"
+    ];
+    default = "host";
+    example = "none";
+    description = ''
+      Where this agent's nix builds run.
+
+      - `host` (default): builds go through the host's nix-daemon socket,
+        which every agent container gets bound in by default. The daemon runs
+        them outside this container, so the container's CPU and memory caps do
+        not apply to a build.
+      - `none`: the container cannot reach the host's nix-daemon, so
+        `nix build`, `nix run`, `nix shell` and the like fail for anything not
+        already in the store, with a "cannot connect to socket" error. The
+        agent's own system closure stays readable.
+
+      The swarm builder reads the option from the evaluated config into the
+      agent's closure record, and the hive applies it when it next starts the
+      container, so a running agent keeps its mode until restarted. A host
+      that does not know the option leaves the agent on `host`.
+    '';
+  };
+
   config = {
     assertions = [
       # Guard the inputs-routed-as-output pattern: the agent flake.nix is
@@ -235,6 +261,10 @@ in
     # Non-root nix clients already default to the daemon socket, so this
     # is a no-op for them; it only matters for root services that would
     # otherwise silently use the local store.
+    #
+    # Stays set under `nixBuilds = "none"`: the missing socket then fails a
+    # build with an error that names it, where the local store would fail on a
+    # read-only filesystem.
     systemd.globalEnvironment.NIX_REMOTE = "daemon";
 
     # `claude-code` is unfree. Each per-agent container's nixosConfiguration