gateway: hot-reload agents.conf at runtime (#869)

Replace eval-time per-agent nginx location baking with a runtime
include file. c0re writes /var/lib/hyperhive/agents.conf (nginx
location blocks, UDS or TCP per agent) on every topology change and
on the 10s marker poll. The gateway container bind-mounts
/var/lib/hyperhive/ at /run/hive-state/ and nginx includes
/run/hive-state/agents.conf. A systemd path unit inside the container
watches the file for changes and fires `nginx -s reload` on each
atomic rename from c0re — no nixos-rebuild switch needed when agents
start, stop, or flip useUnixSocket.

  - new hive-c0re/src/gateway_nginx.rs: write() + render()
  - lib.rs + meta.rs + agent_sockets::spawn_poll: hook in write()
  - hive-gateway.nix: drop agentPortsTable/agentSocketsTable/
    agentUpstreamFor/lib.mapAttrs', add /run/hive-state bind-mount,
    include directive, systemd path unit + reload service, tmpfiles
    for /var/lib/hyperhive + agents.conf seed
  - docs/gateway.md: update vhost table + Per-agent UDS section

hive-c0re/src/meta.rs

@@ -126,6 +126,16 @@ pub async fn sync_agents(
         tracing::warn!(error = ?e, "agent_sockets::write failed (non-fatal)");
     }
 
+    // Refresh /var/lib/hyperhive/agents.conf — the nginx include file
+    // the gateway picks up at runtime without needing a
+    // nixos-rebuild. The gateway container bind-mounts
+    // /var/lib/hyperhive/ and a systemd path unit fires
+    // `nginx -s reload` when this file changes (#869). Same
+    // best-effort + non-fatal shape.
+    if let Err(e) = crate::gateway_nginx::write(&agent_names) {
+        tracing::warn!(error = ?e, "gateway_nginx::write failed (non-fatal)");
+    }
+
     if initial {
         git(&dir, &["init", "--initial-branch=main"]).await?;
     }