agents: read the memory cap at boot, not from the build

An agent's memory cap was rendered into its flake (`memoryMaxBytes` →
`services.hyperhive.agent.claudeMemoryMaxBytes`), so the closure depended
on it and a changed cap reached the JSC heap ceiling and the subagent
`MemoryHigh=` only after a rebuild.

hive-c0re now writes the effective `MemoryMax=` in bytes to the agent's
runtime dir (`/run/hive/memory-max-bytes` inside) in `write_dropins`,
from the same value the drop-in gets. The file is removed for
`infinity` or a RAM percentage, and left alone when the drop-in is kept.

Inside the container, `nix/agent-modules/memory-cap.nix` reads it at
boot: an environment generator sets `BUN_JSC_forceRAMSize` (75%) for
every unit and `machinectl shell`, `/etc/set-environment` exports it in
login shells, and a unit generator writes `MemoryHigh=` (2/3) as a
drop-in for `hive-subagent-daemon`.

The render drops `memoryMaxBytes`, the agent option is removed (both
spellings fail eval with a removal message), and
`effective_memory_bytes_from` goes with its only caller.

Part of #5081 (slice S0-2).

docs/agent-lifecycle/persistence.md

@@ -403,7 +403,8 @@ Contents:
   Written by `resource_limits::set_limits`; read where
   `lifecycle::write_dropins` generates the systemd drop-in, **not** injected
   into the container — these are host-side caps on the container, so
-  the capped party never sees or sets them. Fallback is per *field*:
+  the capped party never sets them. It sees only the resulting memory cap,
+  as a byte count in its runtime dir (below). Fallback is per *field*:
   an absent file, absent agent, or absent field falls back to the
   hive-wide `services.hyperhive.c0re.agentCpuQuota` / `agentMemoryMax`,
   so an agent can override only its memory and still track the hive
@@ -508,6 +509,11 @@ containers can't start.
 - `/run/hyperhive/host.sock` — admin socket (host-side CLI).
 - `/run/hyperhive/agents/<name>/mcp.sock` — per-agent socket
   (bind-mounted into the container as `/run/hive/mcp.sock`).
+- `/run/hyperhive/agents/<name>/memory-max-bytes` — the agent's effective
+  `MemoryMax=` in bytes, written by `lifecycle::write_dropins` before every
+  start (absent when the cap is `infinity` or a RAM percentage). The
+  container reads it at boot as `/run/hive/memory-max-bytes`
+  (`nix/agent-modules/memory-cap.nix`).
 
 On startup, `Coordinator::register_agent` drops any prior socket
 task before rebinding — idempotent so a hive-c0re restart followed