nix: move the agent option namespace under services.hyperhive.agent

Every per-agent harness option lived at the top-level `hyperhive.*` while
the host tier has always been `services.hyperhive.*`. Move all 52 agent-tier
option leaves (33 top-level names across 16 modules) to
`services.hyperhive.agent.*`, repoint every read, and keep existing agent
configs evaluating through one `mkRenamedOptionModule` per old leaf path in
the new nix/agent-modules/renamed-options.nix.

The shims are per leaf rather than per namespace: `user`, `mcp`, `otel`,
`queue`, `docs`, `forge`, `frontend`, `github`, `gui`, `logs`, `matrix` and
`cargo` are plain attrsets of declarations, not submodule-typed options, so
a parent-path rename would not reach their children. Three read-only
options (`frontend.mergedDist`, `queue.clientIdFile`,
`queue.clientSecretFile`) deliberately get no shim — a rename contributes a
definition, which a read-only option refuses; the exclusions are commented
in place.

Refs #4473

nix/agent-modules/default.nix

@@ -4,9 +4,9 @@
 # they came from.
 #
 # This is the core module: container plumbing (boot/nix/nixpkgs),
-# base tooling, and the cross-cutting `hyperhive.icon` option. Each
+# base tooling, and the cross-cutting `services.hyperhive.agent.icon` option. Each
 # feature lives in its own sibling module (imported below) that
-# declares its own `hyperhive.*` options + config.
+# declares its own `services.hyperhive.agent.*` options + config.
 {
   pkgs,
   lib,
@@ -35,6 +35,7 @@
     ./otel.nix
     ./packages.nix
     ./queue.nix
+    ./renamed-options.nix
     ./user.nix
     ./screen.nix
     ./weston-vnc.nix
@@ -48,7 +49,7 @@
     '')
   ];
 
-  options.hyperhive.icon = lib.mkOption {
+  options.services.hyperhive.agent.icon = lib.mkOption {
     type = lib.types.nullOr lib.types.path;
     default = null;
     example = lib.literalExpression "./icon.svg";
@@ -65,7 +66,7 @@
     '';
   };
 
-  options.hyperhive.claudeCodePath = lib.mkOption {
+  options.services.hyperhive.agent.claudeCodePath = lib.mkOption {
     type = lib.types.nullOr lib.types.str;
     default = null;
     example = "/nix/store/…-claude-code-2.1.220";
@@ -108,20 +109,22 @@
             _module.args.flakeInputs = builtins.removeAttrs inputs [ "self" ];
         '';
       }
-      # hyperhive.icon must reference an SVG file when set.
+      # services.hyperhive.agent.icon must reference an SVG file when set.
       {
-        assertion = config.hyperhive.icon == null || lib.hasSuffix ".svg" (toString config.hyperhive.icon);
-        message = "hyperhive.icon must point to an .svg file";
+        assertion =
+          config.services.hyperhive.agent.icon == null
+          || lib.hasSuffix ".svg" (toString config.services.hyperhive.agent.icon);
+        message = "services.hyperhive.agent.icon must point to an .svg file";
       }
     ];
 
-    # Operator-set per-agent icon (hyperhive.icon). When configured, the
+    # Operator-set per-agent icon (services.hyperhive.agent.icon). When configured, the
     # SVG lands at /etc/hyperhive/icon.svg; the harness serves it at
     # GET /icon, 404ing when absent (client-side fallback, no
     # server-side default). Consumed by forge-avatar-sync (./forge.nix)
     # and the matrix avatar sync (./matrix.nix) too.
-    environment.etc."hyperhive/icon.svg" = lib.mkIf (config.hyperhive.icon != null) {
-      source = config.hyperhive.icon;
+    environment.etc."hyperhive/icon.svg" = lib.mkIf (config.services.hyperhive.agent.icon != null) {
+      source = config.services.hyperhive.agent.icon;
     };
 
     boot.isNspawnContainer = true;
@@ -213,11 +216,11 @@
     # `hive-metric` (agent-emitted custom metrics CLI,
     # docs/scheduler/observability.md).
     environment.systemPackages = [
-      config.hyperhive.packages.hive-metric
+      config.services.hyperhive.agent.packages.hive-metric
     ]
     ++ [
       (
-        if config.hyperhive.claudeCodePath == null then
+        if config.services.hyperhive.agent.claudeCodePath == null then
           pkgs.claude-code
         else
           # Host-pinned claude: a symlink farm around a path the
@@ -235,7 +238,7 @@
           # see `services.hyperhive.c0re.claudeCodePackage`.
           pkgs.runCommandLocal "claude-code-pinned" { } ''
             mkdir -p "$out/bin"
-            ln -s ${config.hyperhive.claudeCodePath}/bin/claude "$out/bin/claude"
+            ln -s ${config.services.hyperhive.agent.claudeCodePath}/bin/claude "$out/bin/claude"
           ''
       )
     ]
@@ -262,7 +265,7 @@
     # host-level `services.hyperhive.c0re.contextWindowTokens` option — not
     # set here.
     environment.variables = {
-      HIVE_ASSETS_DIR = "${config.hyperhive.packages.assets}/share/hyperhive";
+      HIVE_ASSETS_DIR = "${config.services.hyperhive.agent.packages.assets}/share/hyperhive";
       SHELL = "${pkgs.bashInteractive}/bin/bash";
       # Route interactive-shell nix invocations through the host daemon.
       # Redundant with /etc/profile.d/nix-daemon.sh but ensures it's set