refactor: remove hyperhive.role option — there is only one role: agent

nix/templates/manager.nix

@@ -2,14 +2,15 @@
 {
   imports = [ ./harness-base.nix ];
 
-  # Manager role: the `systemd.services.hive-ag3nt` unit plus
-  # the manager-only forge defaults (`keepSubscriptions = false`,
-  # `skipNotifyReasons = [ "subscribed" "participating" ]`) live in
-  # `harness-base.nix` under `lib.mkIf (config.hyperhive.role ==
-  # "manager")`. This file is the bare entry-point referenced from
+  # Entry-point for the privileged root agent (ruth). Referenced from
   # `flake.nix` (`nixosConfigurations.ruth`) and the meta-flake's
-  # `applied/ruth/flake.nix`. HIVE_PORT / HIVE_LABEL are injected by
-  # the meta-flake at deploy time and have manager-only standalone-eval
-  # fallbacks in `harness-base.nix`.
-  hyperhive.role = "manager";
+  # `applied/ruth/flake.nix`. Forge subscription/participation firehose
+  # stays off so ruth's inbox isn't drowned in noise.
+  hyperhive.forge = {
+    keepSubscriptions = false;
+    skipNotifyReasons = [
+      "subscribed"
+      "participating"
+    ];
+  };
 }