nix: move the agent option namespace under services.hyperhive.agent

Every per-agent harness option lived at the top-level `hyperhive.*` while
the host tier has always been `services.hyperhive.*`. Move all 52 agent-tier
option leaves (33 top-level names across 16 modules) to
`services.hyperhive.agent.*`, repoint every read, and keep existing agent
configs evaluating through one `mkRenamedOptionModule` per old leaf path in
the new nix/agent-modules/renamed-options.nix.

The shims are per leaf rather than per namespace: `user`, `mcp`, `otel`,
`queue`, `docs`, `forge`, `frontend`, `github`, `gui`, `logs`, `matrix` and
`cargo` are plain attrsets of declarations, not submodule-typed options, so
a parent-path rename would not reach their children. Three read-only
options (`frontend.mergedDist`, `queue.clientIdFile`,
`queue.clientSecretFile`) deliberately get no shim — a rename contributes a
definition, which a read-only option refuses; the exclusions are commented
in place.

Refs #4473

flake.nix

@@ -82,7 +82,7 @@
           agentPackages =
             { lib, pkgs, ... }:
             {
-              hyperhive.packages = lib.mapAttrs (_: lib.mkDefault) {
+              services.hyperhive.agent.packages = lib.mapAttrs (_: lib.mkDefault) {
                 inherit (self.packages.${pkgs.stdenv.hostPlatform.system})
                   hive-agent
                   hive-agent-mcp