refactor: nix/host-modules + nix/agent-modules layout, update doc paths

docs/gotchas.md

@@ -77,7 +77,7 @@ socket without needing a clean reinstall.
 ## `claude-code` is unfree
 
 `claude-code` comes from the flake's main `nixpkgs` (nixos-26.05).
-It's unfree, so `harness-base.nix` sets `config.allowUnfreePredicate`
+It's unfree, so the agent modules set `config.allowUnfreePredicate`
 at the container level to whitelist `claude-code` specifically —
 scoped, only this one package. This is needed because each per-agent
 `nixosConfiguration` evaluates its own nixpkgs instance and the
@@ -204,7 +204,7 @@ containers don't get user-namespaces by default, so `nix build`
 invocations _inside_ the container can't set up the build sandbox
 and fail outright if the host daemon's
 `nix.settings.sandbox-fallback` is `false` (nixpkgs default).
-`nix/templates/harness-base.nix` does `lib.mkForce true` so builds
+`nix/agent-modules/default.nix` does `lib.mkForce true` so builds
 fall back to unsandboxed local builds rather than failing. Security
 implications: `docs/security.md`.
 
@@ -284,7 +284,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
   inherit it.
 - **Fixed Wayland socket name (`--socket=wayland-0`)**: weston is
   launched with `--socket=wayland-0` so the socket path is
-  deterministic. `harness-base.nix` exports `WAYLAND_DISPLAY=wayland-0`
+  deterministic. `nix/agent-modules/weston-vnc.nix` exports `WAYLAND_DISPLAY=wayland-0`
   and `XDG_RUNTIME_DIR=/run/gui` as global system environment
   variables (gated on `hyperhive.gui.enable`) so every systemd service
   in the container inherits them. Without this, services starting
@@ -311,7 +311,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
   must never block on weston signalling readiness. A misconfigured
   weston degrades to a `Restart=on-failure` loop visible in
   `journalctl`, it does not abort the `nixos-container update`.
-  Same reasoning as the `tea-login` unit in `harness-base.nix`.
+  Same reasoning as the `tea-login` unit in `nix/agent-modules/forge.nix`.
 - **`[core] idle-time=0`**: disables weston's 300-second idle
   timeout. Without it the VNC desktop fades to black and
   desktop-shell shows its click-to-unlock screen — useless for an
@@ -325,7 +325,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
 `pkgs.nixosOptionsDoc` over two evaluated module trees:
 `hostEval` (a stub NixOS system loading `hive-c0re.nix` with every
 hyperhive subsystem `mkForce false` so heavy build inputs stay out of
-the eval) and `agentEval` (evaluates `agent-base.nix` fresh for the
+the eval) and `agentEval` (evaluates `agent.nix` fresh for the
 per-agent options tree).
 
 Three output trees consumed by `flake.nix`, all **markdown**:
@@ -333,7 +333,7 @@ Three output trees consumed by `flake.nix`, all **markdown**:
 - `docs-host` — operator-facing host module options
   (`services.hyperhive.*`)
 - `docs-agent` — per-agent harness options (`hyperhive.*`
-  declared in `nix/templates/harness-base.nix`)
+  declared in `nix/agent-modules/`)
 - `docs` — bundle of `index.md` + `host.md` + `agent.md`
 
 Pipeline: