nix: replace weston RDP backend with VNC, add hyperhive.gui.enable option

Removes weston-rdp.nix (hyperhive.westonRdp.enable) and adds
weston-vnc.nix (hyperhive.gui.enable).

The ExecStart wrapper script computes a deterministic VNC port via
FNV-1a hash of the agent name (derived from hostname, same algorithm
as lifecycle::agent_web_port) in the range [15900, 16799], then writes
/etc/hyperhive/gui.json {"vnc_port": N, "auth": "none"} for the
harness WebSocket relay (issue #51), and execs weston with the VNC
backend + pixman renderer.

Type=simple so it can never abort nixos-container update; a
misconfigured weston degrades to a restart loop, not a blocked rebuild.

Closes #50

nix/templates/harness-base.nix

@@ -13,7 +13,7 @@
   # Optional feature modules. Each declares its own `hyperhive.*`
   # option(s), default-off, so every agent has them available but
   # only opts in from its own `agent.nix`.
-  imports = [ ./weston-rdp.nix ];
+  imports = [ ./weston-vnc.nix ];
 
   options.hyperhive.allowedBashPatterns = lib.mkOption {
     type = lib.types.listOf lib.types.str;