subagent: let the daemon see the tool groups it resolves --tools from

`build_config` now resolves a subagent's `--tools` from
`HIVE_TOOL_GROUPS`, the same var the harness resolves its own session
from — but the meta renderer writes that var onto the `hive-agent` unit
alone (`systemd.services.${service}.environment`), and the subagent
daemon is a separate unit. It would therefore have resolved the default
groups no matter what the agent was actually granted.

That direction is safe — the default groups add no built-ins, so the
resolution is a subset of the parent's either way, never a superset — but
it isn't what the code says it does: an agent granted `web_tools` would
spawn subagents silently without `WebFetch`/`WebSearch`, and the "same
set as the parent" property would be true only for agents whose groups
happen not to matter.

Forward the var onto the daemon's unit, read off the harness unit rather
than re-derived, so there is one place it is decided. Absent stays
absent: `or null`, which systemd drops from the unit, leaving the daemon
the same fallback the harness would take.

Refs #4416

nix/agent-modules/mcp.nix

@@ -378,6 +378,16 @@ in
         # HIVE_AGENT_SOCKET (agent-service.nix).
         HIVE_AGENT_SOCKET = "/run/hive-agent/${userName}/agent.sock";
         RUST_LOG = "info";
+        # This daemon resolves each subagent's `--tools` from the same
+        # tool groups the harness resolves its own session from, so that a
+        # subagent's built-in tools are its parent agent's and never wider.
+        # The meta renderer writes this var onto the harness unit alone, so
+        # forward it from there rather than re-deriving it: without it the
+        # daemon falls back to the default groups and an agent granted
+        # `web_tools` would spawn subagents that quietly lack web access.
+        # `null` when the agent has no groups declared, which systemd drops
+        # — the same "absent" the harness itself would see.
+        HIVE_TOOL_GROUPS = config.systemd.services.hive-agent.environment.HIVE_TOOL_GROUPS or null;
         # HYPERHIVE_HARNESS_DIR / HYPERHIVE_STATE_DIR: see
         # `hive-bash-daemon`'s own comment above — same global injection,
         # same reasoning.