nix: pivot to services.hyperhive.* per mara directive (#612)

Per [mara on PR #615 comment 7349](http://localhost:3000/hyperhive/hyperhive/pulls/615#issuecomment-7349):
> follow nix conventions, services.hyperhive it is. the earlier we
> change this, the less breakage.

Renames the entire host-side option tree under `services.hyperhive.*`:

- `services.hive-c0re.*` → `services.hyperhive.c0re.*`
- `hyperhive.enable` → `services.hyperhive.enable`
- `hyperhive.domain` → `services.hyperhive.domain`
- `hyperhive.forge.*` → `services.hyperhive.forge.*`
- `hyperhive.matrix.*` → `services.hyperhive.matrix.*`

Per mara's "earlier = less breakage", the previous `services.hive-c0re.enable`
deprecation alias is dropped. Operators get a clear eval error on the
old paths pointing at the rename. Single migration moment.

Per-agent options in `nix/templates/harness-base.nix` (`hyperhive.model`,
`hyperhive.allowedRecipients`, etc.) stay at `hyperhive.*` — they're
container-level config, not services in the NixOS sense.

Verified via `nix flake check --no-build` + an end-to-end NixOS eval
exercising every renamed path.

Follow-up needed: rust source comments referencing the old NixOS
option names (`hive-c0re/src/{meta,coordinator,main,dashboard}.rs`)
should be updated in a separate pure-rust PR to keep this one
strictly nix-only.

flake.nix

@@ -225,7 +225,7 @@
         agent-base = ./nix/templates/agent-base.nix;
         manager = ./nix/templates/manager.nix;
         # The hive-c0re module wants `pkgs.hyperhive` for its default
-        # `hyperhive.c0re.package`. To avoid making operators apply an
+        # `services.hyperhive.c0re.package`. To avoid making operators apply an
         # overlay (which would also pollute their host pkgs with our
         # build), we thread the package straight from this flake's
         # `packages.<system>.default` via a `hyperhivePackage` argument.
@@ -237,7 +237,7 @@
           hyperhiveAssets = system: self.packages.${system}.assets;
           hyperhiveFlake = "${self}";
           # Per-container toplevels — wired into `system.extraDependencies`
-          # when `hyperhive.c0re.preBuildAgentTemplates` is on so the
+          # when `services.hyperhive.c0re.preBuildAgentTemplates` is on so the
           # host system closure pre-fetches the heavy build inputs (#97).
           # Defined only for x86_64-linux because nixosConfigurations are
           # hardcoded to that system; the option's default keeps the
@@ -252,7 +252,7 @@
         # in hive-forge). Intended usage:
         #
         #   imports = [ hyperhive.nixosModules.default ];
-        #   hyperhive.enable = true;
+        #   services.hyperhive.enable = true;
         #
         default = self.nixosModules.hive-c0re;
       };