fix(#2860): no loopback default for the matrix homeserver

Third and last of #2860's agent-facing URL fallbacks. The operator's
ruling was "any special casing is done on the nix side - same binaries,
no hard coded fallback", so the default is deleted rather than replaced.

Every layer guessed the same wrong thing, and each guess was only ever
correct for a process sharing the host netns:

- nix/agent-modules/matrix.nix: matrixUrlDefault = localhost:8008, both
  as the option's default and as a sentinel the daemon unit compared
  against to decide whether to write HIVE_MATRIX_URL. Now nullOr str,
  default null, the guard is != null, and the doc says what forge.url's
  already says: null means "no matrix", not "guess one".
- nix/host-modules/hive-c0re/environment.nix: forwarded
  http://127.0.0.1:<port> when no gatewayHost was set. hive-c0re shares
  the host netns so it reads as harmless, but the value is handed to
  agents, which do not -- there it names the agent itself. Now forwarded
  only when there is a gateway vhost to name, matching the guard
  HIVE_MATRIX_PUBLIC_URL already uses twelve lines below.
- hive-matrix-mcp: paths::DEFAULT_HOMESERVER was the same address
  compiled in, so dropping the nix defaults alone would have left the
  daemon dialling loopback inside the agent's own netns -- the very bug,
  one layer down. homeserver_url() is now Option, and an account with no
  homeserver is skipped with a log, exactly as one with no token is.
  discover_token_accounts already refused to guess for the same reason.

Two comments taught the assumption back to the next reader ("shared host
netns means every agent container resolves localhost to the same
machine"); both now say which side of the netns boundary they describe.
MATRIX_HTTP keeps its value -- hive-c0re really does share the host
netns -- but no longer claims agents do.

Gated with nix eval against the extended agent-base config, as a pair:
with no url set the daemon unit carries no HIVE_MATRIX_URL, and with one
set it carries exactly that. Either check alone passes on a broken guard.

hive-matrix-mcp/src/accounts.rs

@@ -46,13 +46,15 @@ pub struct AccountCfg {
 }
 
 impl AccountCfg {
-    /// Resolve the effective homeserver URL (per-account override or
-    /// the daemon-wide default).
+    /// The effective homeserver URL — this account's own, else the
+    /// daemon-wide `HIVE_MATRIX_URL` — or `None` when neither is set.
+    ///
+    /// `None` is a real answer, not a failure: the account is skipped, the
+    /// same way [`discover_token_accounts_in`] already skips a discovered
+    /// token whose homeserver sidecar is missing.
     #[must_use]
-    pub fn homeserver(&self) -> String {
-        self.homeserver
-            .clone()
-            .unwrap_or_else(paths::homeserver_url)
+    pub fn homeserver(&self) -> Option<String> {
+        self.homeserver.clone().or_else(paths::homeserver_url)
     }
 }
 

hive-matrix-mcp/src/main.rs

@@ -265,7 +265,17 @@ async fn bring_up_account(
     tag: Option<String>,
     is_primary: bool,
 ) -> Result<Option<(Client, SyncLoop)>> {
-    let homeserver = cfg.homeserver();
+    let Some(homeserver) = cfg.homeserver() else {
+        // No homeserver for this account: the hive has none to offer (no
+        // matrix vhost) or this agent's `hyperhive.matrix.url` is null. Same
+        // no-op as a missing token — an absent integration, not a guess at
+        // one.
+        tracing::info!(
+            account = %cfg.name,
+            "no homeserver configured (HIVE_MATRIX_URL unset); skipping account"
+        );
+        return Ok(None);
+    };
     if !tokio::fs::try_exists(&cfg.token_file)
         .await
         .unwrap_or(false)

hive-matrix-mcp/src/paths.rs

@@ -6,12 +6,6 @@
 
 use std::path::PathBuf;
 
-/// Default homeserver URL when `HIVE_MATRIX_URL` isn't set. Tuwunel
-/// (the local hive-matrix container) listens on `localhost:8008` by
-/// default; shared host netns means every agent container resolves
-/// `localhost` to the same machine.
-pub const DEFAULT_HOMESERVER: &str = "http://localhost:8008";
-
 /// Resolve the matrix access-token file path. Override via
 /// `HIVE_MATRIX_TOKEN_FILE`; default is `<HYPERHIVE_STATE_DIR>/matrix-token`,
 /// the path `hive-c0re::matrix::ensure_user_for` writes to on agent
@@ -25,11 +19,19 @@ pub fn token_file() -> PathBuf {
     PathBuf::from(format!("{state_dir}/matrix-token"))
 }
 
-/// Resolve the homeserver URL. Override via `HIVE_MATRIX_URL`; default
-/// is the in-container `localhost:8008` tuwunel.
+/// Resolve the homeserver URL from `HIVE_MATRIX_URL`, or `None` when the
+/// harness didn't set one.
+///
+/// There is deliberately no built-in default. A hardcoded `localhost:8008`
+/// used to stand in here, on the reasoning that the tuwunel container shares
+/// the host netns — but *this daemon runs inside an agent*, which does not, so
+/// that address named the agent itself. Unset means the hive has no homeserver
+/// to offer this agent, and the daemon no-ops exactly as it does without a
+/// token; guessing would be a value that starts fine and then talks to the
+/// wrong machine.
 #[must_use]
-pub fn homeserver_url() -> String {
-    std::env::var("HIVE_MATRIX_URL").unwrap_or_else(|_| DEFAULT_HOMESERVER.to_owned())
+pub fn homeserver_url() -> Option<String> {
+    std::env::var("HIVE_MATRIX_URL").ok()
 }
 
 /// Persistent sqlite store directory for matrix-sdk's state (event