feat(#2363): full-DHCP for all agents — drop static agent_network_ip

All agent containers now receive their bridge IP dynamically via DHCP
from the dnsmasq pool instead of a hash-derived static address:

- nix/templates/harness-base.nix: networking.useDHCP = true
- nix/modules/hive-gateway.nix: expand DHCP pool to full usable range
  (.2 to .254 on /24) — was last-14-IPs-only
- hive-sh4re/src/priv_proto.rs: remove agent_ip from NetworkIsolation
- hive-c0re/src/lifecycle/mod.rs: drop agent_network_ip + DHCP_POOL_SIZE
- hive-c0re/src/lifecycle/host_config.rs: remove agent_network_ip call
- hive-priv/src/main.rs: LOCAL_ADDRESS= empty (DHCP assigns IP);
  HOST_ADDRESS still set so nixos-container installs default route
  before the DHCP lease arrives
- nix/dhcp-pool-size: deleted (no longer needed)

The nix/dhcp-pool-size single-source-of-truth file and all associated
Rust/Nix dual-constant plumbing are gone — there is no static map.
bridge_gateway_ip() is retained (still needed for HOST_ADDRESS).

Closes #2363

hive-priv/src/main.rs

@@ -1487,7 +1487,11 @@ fn write_nspawn_flags(
         // setup is skipped, so this only affects the container's route —
         // exactly what we want.
         let _ = writeln!(out, "HOST_ADDRESS={}", iso.gateway_ip);
-        let _ = writeln!(out, "LOCAL_ADDRESS={}", iso.agent_ip);
+        // LOCAL_ADDRESS is intentionally empty: agent containers receive their
+        // IP dynamically via DHCP from the bridge dnsmasq pool.  HOST_ADDRESS
+        // (the gateway IP) is still written so nixos-container's container-side
+        // init installs a default route before the DHCP lease arrives.
+        out.push_str("LOCAL_ADDRESS=\n");
         out.push_str("HOST_ADDRESS6=\n");
         out.push_str("LOCAL_ADDRESS6=\n");
         let _ = writeln!(out, "HOST_BRIDGE={}", iso.bridge);