move nixBuilds into its own agent module, and have the vm test's agent import it

nix/agent-modules/default.nix

@@ -91,6 +91,7 @@ in
     ./memory-cap.nix
     ./metrics.nix
     ./network.nix
+    ./nix-builds.nix
     ./otel.nix
     ./otel-removed.nix
     ./packages.nix
@@ -135,34 +136,6 @@ in
     '';
   };
 
-  options.services.hyperhive.agent.nixBuilds = lib.mkOption {
-    type = lib.types.enum [
-      "host"
-      "none"
-    ];
-    default = "host";
-    example = "none";
-    description = ''
-      Where this agent's nix builds run.
-
-      - `host` (default): builds go through the host's nix-daemon socket,
-        which every agent container gets bound in by default. The daemon runs
-        them outside this container, so the container's CPU and memory caps do
-        not apply to a build.
-      - `none`: the container cannot reach the host's nix-daemon, so
-        `nix build`, `nix run`, `nix shell` and the like fail for anything not
-        already in the store, with a "cannot connect to socket" error. The
-        agent's own system closure stays readable.
-        The container's own nix-daemon socket and service are off, so nothing
-        in the container listens on that path either.
-
-      The swarm builder reads the option from the evaluated config into the
-      agent's closure record, and the hive applies it when it next starts the
-      container, so a running agent keeps its mode until restarted. A host
-      that does not know the option leaves the agent on `host`.
-    '';
-  };
-
   config = {
     assertions = [
       # Guard the inputs-routed-as-output pattern: the agent flake.nix is
@@ -269,19 +242,6 @@ in
     # read-only filesystem.
     systemd.globalEnvironment.NIX_REMOTE = "daemon";
 
-    # Under `nixBuilds = "none"` the daemon directory is an empty tmpfs, which
-    # the nix-daemon socket unit's `ConditionPathIsReadWrite` accepts, so the
-    # container's own daemon would listen there and hand out the very socket
-    # the mode withholds. Under `host` the directory is the host's read-only
-    # bind, the condition fails, and the unit stays inactive. `nix.enable`
-    # stays on, so the client and the read-only store remain usable.
-    systemd.sockets.nix-daemon.enable = lib.mkIf (
-      config.services.hyperhive.agent.nixBuilds == "none"
-    ) false;
-    systemd.services.nix-daemon.enable = lib.mkIf (
-      config.services.hyperhive.agent.nixBuilds == "none"
-    ) false;
-
     # `claude-code` is unfree. Each per-agent container's nixosConfiguration
     # evaluates its own `nixpkgs` instance, so the operator's host-level
     # `nixpkgs.config.allowUnfreePredicate` does not propagate into here —

nix/agent-modules/nix-builds.nix

@@ -0,0 +1,46 @@
+# Where the agent's nix builds run: `services.hyperhive.agent.nixBuilds`.
+#
+# The mode reaches the container's start flags through the closure record
+# (hive-priv adds `--tmpfs=/nix/var/nix/daemon-socket` for `none`); this module
+# is the part inside the container's own NixOS config.
+{ lib, config, ... }:
+{
+  options.services.hyperhive.agent.nixBuilds = lib.mkOption {
+    type = lib.types.enum [
+      "host"
+      "none"
+    ];
+    default = "host";
+    example = "none";
+    description = ''
+      Where this agent's nix builds run.
+
+      - `host` (default): builds go through the host's nix-daemon socket,
+        which every agent container gets bound in by default. The daemon runs
+        them outside this container, so the container's CPU and memory caps do
+        not apply to a build.
+      - `none`: the container cannot reach the host's nix-daemon, so
+        `nix build`, `nix run`, `nix shell` and the like fail for anything not
+        already in the store, with a "cannot connect to socket" error. The
+        agent's own system closure stays readable.
+        The container's own nix-daemon socket and service are off, so nothing
+        in the container listens on that path either.
+
+      The swarm builder reads the option from the evaluated config into the
+      agent's closure record, and the hive applies it when it next starts the
+      container, so a running agent keeps its mode until restarted. A host
+      that does not know the option leaves the agent on `host`.
+    '';
+  };
+
+  # Under `none` the daemon directory is an empty tmpfs, which the nix-daemon
+  # socket unit's `ConditionPathIsReadWrite` accepts, so the container's own
+  # daemon would listen there and hand out the very socket the mode withholds.
+  # Under `host` the directory is the host's read-only bind, the condition
+  # fails, and the unit stays inactive. `nix.enable` stays on, so the client and
+  # the read-only store remain usable.
+  config = lib.mkIf (config.services.hyperhive.agent.nixBuilds == "none") {
+    systemd.sockets.nix-daemon.enable = false;
+    systemd.services.nix-daemon.enable = false;
+  };
+}