programs.git.enable + harness PATH tracks systemPackages

- harness-base.nix: switch to programs.git for declarative gitconfig.
- agent + manager service path = /run/current-system/sw → agents pick up
  new packages from their own agent.nix without harness edits.
- generated applied/<name>/flake.nix overrides programs.git.config.user
  (no more raw etc.gitconfig collision).

nix/templates/harness-base.nix

@@ -13,23 +13,28 @@
     hyperhive
     claude-code
     bashInteractive
-    git
     coreutils-full
   ];
+
+  # Git is needed by claude's Bash tool (for the agent <-> manager config
+  # request flow) and by hive-c0re's own setup_applied / setup_proposed.
+  # `programs.git.enable` installs the binary + manages `/etc/gitconfig`
+  # declaratively so the inline module in `applied/<name>/flake.nix` can
+  # override `user.name` / `user.email` per agent without fighting a raw
+  # `environment.etc."gitconfig"` block.
+  programs.git = {
+    enable = true;
+    config = {
+      user = {
+        name = "hyperhive";
+        email = "hyperhive@local";
+      };
+      init.defaultBranch = "main";
+    };
+  };
+
   # claude's Bash tool refuses to run without a POSIX shell + $SHELL set.
   environment.variables.SHELL = "${pkgs.bashInteractive}/bin/bash";
 
-  # Default gitconfig for any commits the harness makes. The per-agent
-  # `applied/<name>/flake.nix` overrides this with the agent's own name +
-  # email; this fallback only kicks in if the container is built straight
-  # from `agent-base` / `manager` without the per-agent extension.
-  environment.etc."gitconfig".text = ''
-    [user]
-      name = hyperhive
-      email = hyperhive@local
-    [init]
-      defaultBranch = main
-  '';
-
   system.stateVersion = "25.11";
 }