docs(turn-loop): move harness systemd unit shape out of agent-roster.md

Moves the "Harness systemd unit shape" section from
docs/agent-lifecycle/agent-roster.md into docs/turn-loop/README.md: it
describes the per-agent harness systemd unit (env vars, PATH wiring,
serviceConfig), which is turn-loop material, not roster material.

Fixes two facts while moving: the ExecStart package is `hive-agent`,
not `hyperhive` (no package by that name exists); and `ruth.nix`
doesn't set any forge subscription default — it only defaults
`services.hyperhive.agent.docs.enable`.

Updates the inbound pointers in docs/turn-loop/config.md and the
module comment at nix/agent-modules/agent-service.nix.

Refs #3902

docs/agent-lifecycle/agent-roster.md

@@ -136,69 +136,6 @@ through it the same way everywhere.
 None of the above is a stable interface — treat the module doc
 comments as the source of truth for exactly which checks exist today.
 
-## Harness systemd unit shape
-
-One harness serve binary (`hive-agent`, with its `hive-agent-mcp`
-sibling), one shared `nix/agent-modules/` tree, one service unit
-(`systemd.services.hive-agent`) for all agents. No separate manager
-service name or role distinction exists in the harness — privilege
-differences live server-side in the broker socket (which tool groups
-and manager-surface calls each agent receives).
-
-`agent.nix` and `ruth.nix` both import the shared `nix/agent-modules/`.
-`ruth.nix` additionally sets forge defaults to suppress the
-subscription/participation firehose so ruth's inbox stays focused on
-direct mentions, reviews, and assignments.
-
-### Environment variables set on the unit
-
-- `HOME = /home/<userName>` — systemd defaults `HOME` to `/` for
-  services without `User=` set; with the per-agent user the harness
-  needs the right home so claude finds its bind-mounted `~/.claude/`
-  session dir.
-- `HIVE_STATIC_DIR = <mergedDist>` — `tower_http::ServeDir` root for
-  the per-agent web UI; merged dist = agent default + every
-  `services.hyperhive.agent.frontend.extraFiles` overlay.
-- `HIVE_ASSETS_DIR = pkgs.hyperhive-assets/share/hyperhive` — set
-  directly on the unit, **not** via `environment.variables`, because
-  the latter only populates `/etc/profile` which systemd services
-  don't inherit.
-
-### `PATH` setup (the wrapper-dir trick)
-
-```nix
-path = [ "/run/wrappers" "/run/current-system/sw" ];
-```
-
-<!-- vale write-good.Passive = NO -->
-
-`/run/wrappers` (not `/run/wrappers/bin`) comes first so setuid
-wrappers — notably `sudo` — resolve before bare nix-store binaries; see
-[`docs/process/gotchas.md`](../process/gotchas.md) ("`systemd.services.*.path` appends
-`/bin` to every entry") for why the trailing `/bin` matters in
-general. It's load-bearing here because the harness runs as the
-per-agent user: without the wrapper dir on `PATH`, `sudo` resolves to
-the non-setuid nix-store binary and every
-`services.hyperhive.agent.user.passwordlessSudo` grant fails with "must be owned by
-uid 0 and have the setuid bit set."
-
-<!-- vale write-good.Passive = YES -->
-
-### `serviceConfig` highlights
-
-- `ExecStart = pkgs.hyperhive/bin/hive-agent` — same binary for every
-  agent.
-- `Restart = on-failure`, `RestartSec = 2` — keeps the harness
-  resilient across transient crashes without thundering retries.
-- `RuntimeDirectory = "hive-config"` → `/run/hive-config/` owned by
-  `User=`, autocleared on stop. The harness writes regenerated
-  `claude-{mcp-config,settings,system-prompt}` files there
-  (`paths::config_dir`). Deliberately separate from `/run/hive`, which
-  the host bind-mounts in root-owned and which holds hive-c0re's
-  `mcp.sock`.
-- `User = Group = userName` — drops root inside the container; sudo is
-  the explicit escalation surface (`services.hyperhive.agent.user.passwordlessSudo`).
-
 ## Cross-references
 
 - Milestone: "Agent privileges and sub-agents" (tracked internally)