fix(systemd): set explicit SyslogIdentifier on hyperhive-declared units

Follow-up to the harness fix: any unit whose ExecStart is a generated
wrapper (a NixOS `script =` block or a writeShellScript) gets its journal
SyslogIdentifier derived from the wrapper's store-path basename — an
opaque, unstable name. Pin an explicit stable identifier on every unit
hyperhive declares.

script/wrapper units (leaked store paths): forgejo-gpg-init,
hive-gateway-self-signed-cert, hive-tls-ca, hive-ci-prefetch,
hyperhive-isolated-dns, tea-login, forge-avatar-sync,
matrix-avatar-sync, hive-dashboard-links.

direct-binary units (basename already sane; explicit for tidiness +
future-proofing): hive-c0re, hive-priv, hive-matrix-daemon,
hive-bash-daemon, weston.

Only changes the displayed line identifier; journalctl -u <unit>
filtering (keys on _SYSTEMD_UNIT) is unaffected.

nix/modules/hive-c0re.nix

@@ -973,6 +973,7 @@ in
           };
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/hive-c0re --socket /run/hyperhive/host.sock serve --config ${serveConfig}";
+        SyslogIdentifier = "hive-c0re";
         # Migrate hive-c0re's *own* state to the service user after an
         # upgrade from a root-run install (systemd's StateDirectory only
         # chowns the top-level dir, not pre-existing files inside it). The
@@ -1109,6 +1110,7 @@ in
       };
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/hive-priv";
+        SyslogIdentifier = "hive-priv";
         Type = "simple";
         User = "root";
         PrivateTmp = true;

nix/modules/hive-ci.nix

@@ -319,6 +319,9 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         ExecStart = prefetchScript;
+        # Pin the journal identity; ExecStart is a writeShellScript whose
+        # store-path basename would otherwise be the journal identifier.
+        SyslogIdentifier = "hive-ci-prefetch";
       };
     };
 

nix/modules/hive-forge.nix

@@ -364,6 +364,8 @@ in
               Type = "oneshot";
               User = "forgejo";
               Group = "forgejo";
+              # Pin the journal identity (else it's the `script` store-path wrapper).
+              SyslogIdentifier = "forgejo-gpg-init";
             };
             # GNUPGHOME = the keyring forgejo signs from; HOME so
             # `git config --global` lands where the forgejo process reads it.

nix/modules/hive-gateway.nix

@@ -830,6 +830,8 @@ in
             serviceConfig = {
               Type = "oneshot";
               RemainAfterExit = true;
+              # Pin the journal identity (else it's the `script` store-path wrapper).
+              SyslogIdentifier = "hive-gateway-self-signed-cert";
             };
             path = [ pkgs.coreutils ];
             script = ''

nix/modules/hive-tls.nix

@@ -100,6 +100,8 @@ in
         Type = "oneshot";
         RemainAfterExit = true;
         UMask = "0077";
+        # Pin the journal identity (else it's the `script` store-path wrapper).
+        SyslogIdentifier = "hive-tls-ca";
       };
       script = ''
         set -euo pipefail

nix/templates/harness-base.nix

@@ -1270,6 +1270,9 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        # Pin the journal identity; without it systemd derives it from the
+        # generated `script` store-path wrapper (an opaque `<hash>-…-start`).
+        SyslogIdentifier = "hyperhive-isolated-dns";
       };
       path = [ pkgs.coreutils ];
       script = ''
@@ -1294,6 +1297,8 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        # Pin the journal identity (else it's the `script` store-path wrapper).
+        SyslogIdentifier = "tea-login";
       };
       path = [
         pkgs.curl
@@ -1371,6 +1376,8 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = false;
+        # Pin the journal identity (else it's the `script` store-path wrapper).
+        SyslogIdentifier = "forge-avatar-sync";
       };
       path = [
         pkgs.curl
@@ -1469,6 +1476,7 @@ in
       };
       serviceConfig = {
         ExecStart = "${pkgs.hyperhive}/bin/hive-matrix-daemon";
+        SyslogIdentifier = "hive-matrix-daemon";
         Restart = "on-failure";
         RestartSec = 5;
         User = userName;
@@ -1524,6 +1532,7 @@ in
       };
       serviceConfig = {
         ExecStart = "${pkgs.hyperhive}/bin/hive-bash-daemon";
+        SyslogIdentifier = "hive-bash-daemon";
         Restart = "on-failure";
         RestartSec = 3;
         User = userName;
@@ -1577,6 +1586,8 @@ in
         # RemainAfterExit = false so the .path trigger can re-fire
         # the unit (see docs/persistence.md::matrix-avatar-sync).
         RemainAfterExit = false;
+        # Pin the journal identity (else it's the `script` store-path wrapper).
+        SyslogIdentifier = "matrix-avatar-sync";
       };
       path = [
         pkgs.curl
@@ -1679,6 +1690,8 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        # Pin the journal identity (else it's the `script` store-path wrapper).
+        SyslogIdentifier = "hive-dashboard-links";
       };
       environment.LINKS_JSON = builtins.toJSON config.hyperhive.dashboardLinks;
       script = ''

nix/templates/weston-vnc.nix

@@ -136,6 +136,10 @@ in
             --socket=wayland-0 \
             --disable-transport-layer-security
         '';
+        # ExecStart is already a direct `weston` exec (basename is clean), but
+        # pin the identity explicitly so it can't drift if a wrapper is ever
+        # introduced (sweep per the systemd SyslogIdentifier convention).
+        SyslogIdentifier = "weston";
         Restart = "on-failure";
         RestartSec = "5s";
       };