feat(#1970): host services.hyperhive.github.enable (default true) + meta.rs propagation of the off-switch

hive-c0re/src/meta.rs

@@ -1041,6 +1041,14 @@ where
             out.push_str("              hyperhive.otel.debug = true;\n");
         }
     }
+    // GitHub integration is on by default in every agent
+    // (`hyperhive.github.enable`); the host turns it off hive-wide via
+    // `services.hyperhive.github.enable = false`, surfaced here as the
+    // `HYPERHIVE_GITHUB_DISABLED` env on hive-c0re's unit. Only the OFF
+    // override is propagated — the enabled default needs no per-agent line.
+    if std::env::var_os("HYPERHIVE_GITHUB_DISABLED").is_some() {
+        out.push_str("              hyperhive.github.enable = false;\n");
+    }
     out.push_str(
         r#"              # The harness service inside the container runs as a
               # non-root unix user named after the agent (`damocles`,
@@ -1745,4 +1753,44 @@ mod tests {
             "no otel lines when disabled:\n{off}"
         );
     }
+
+    #[test]
+    fn render_flake_injects_github_disable_only_when_signalled() {
+        // services.hyperhive.github.enable = false -> HYPERHIVE_GITHUB_DISABLED
+        // on hive-c0re's unit -> `hyperhive.github.enable = false` injected into
+        // every agent. On by default, so nothing is emitted unless disabled.
+        //
+        // SAFETY: single-threaded mutation of an env var no other test asserts
+        // on; restored before returning.
+        let render = || {
+            render_flake(
+                "github:example/hyperhive",
+                "path:/nix/store/bbbb-hyperhive-docs-source",
+                "path:/nix/store/aaaa-nixpkgs-source",
+                8000,
+                "she/her",
+                &std::collections::HashMap::new(),
+                &[sample_spec("alice", false, 9001)],
+            )
+        };
+        unsafe {
+            std::env::remove_var("HYPERHIVE_GITHUB_DISABLED");
+        }
+        let on_default = render();
+        unsafe {
+            std::env::set_var("HYPERHIVE_GITHUB_DISABLED", "1");
+        }
+        let disabled = render();
+        unsafe {
+            std::env::remove_var("HYPERHIVE_GITHUB_DISABLED");
+        }
+        assert!(
+            !on_default.contains("hyperhive.github.enable"),
+            "github.enable must not be emitted by default (agents keep the true default):\n{on_default}"
+        );
+        assert!(
+            disabled.contains("hyperhive.github.enable = false;"),
+            "github.enable = false must be injected when the host disables it:\n{disabled}"
+        );
+    }
 }