fix(network): order isolated-DNS oneshot before the harness

Follow-up to the isolated-container egress fix. The hyperhive-isolated-dns
oneshot (which rewrites resolv.conf to the bridge resolver) was ordered
before network-online.target + tea-login, but NOT relative to the harness
(hive-ag3nt) or the matrix daemon. hive-ag3nt only declares
`after network.target`, so on first boot its first-turn api.anthropic.com
lookup could race ahead of the resolv.conf rewrite and error (self-heals
next turn, but flaps the first one).

Add hive-ag3nt.service + hive-matrix-daemon.service to the oneshot's
`before` so DNS is fixed before any network consumer starts. The matrix
entry is a harmless no-op when matrix is disabled (unit absent).

Caught by damocles in review of the parent PR.

nix/templates/harness-base.nix

@@ -1040,9 +1040,19 @@ in
       description = "point resolv.conf at the hive bridge resolver (isolated containers)";
       wantedBy = [ "multi-user.target" ];
       after = [ "local-fs.target" ];
+      # Ordered before every network consumer that does DNS on first
+      # boot. `hive-ag3nt` (the harness) is the load-bearing one: its
+      # first-turn api.anthropic.com lookup must not race the resolv.conf
+      # rewrite (it only declares `after network.target`, so without this
+      # edge the harness can start before we've fixed resolv.conf and the
+      # first turn errors — self-heals next turn, but better not to flap).
+      # `hive-matrix-daemon` likewise syncs over the network; the `before`
+      # is a harmless no-op when matrix is disabled (the unit is absent).
       before = [
         "network-online.target"
         "tea-login.service"
+        "hive-ag3nt.service"
+        "hive-matrix-daemon.service"
       ];
       unitConfig.ConditionPathExists = "/etc/hyperhive-bridge-dns";
       serviceConfig = {