feat(#2363): full-DHCP for all agents — drop static agent_network_ip

All agent containers now receive their bridge IP dynamically via DHCP
from the dnsmasq pool instead of a hash-derived static address:

- nix/templates/harness-base.nix: networking.useDHCP = true
- nix/modules/hive-gateway.nix: expand DHCP pool to full usable range
  (.2 to .254 on /24) — was last-14-IPs-only
- hive-sh4re/src/priv_proto.rs: remove agent_ip from NetworkIsolation
- hive-c0re/src/lifecycle/mod.rs: drop agent_network_ip + DHCP_POOL_SIZE
- hive-c0re/src/lifecycle/host_config.rs: remove agent_network_ip call
- hive-priv/src/main.rs: LOCAL_ADDRESS= empty (DHCP assigns IP);
  HOST_ADDRESS still set so nixos-container installs default route
  before the DHCP lease arrives
- nix/dhcp-pool-size: deleted (no longer needed)

The nix/dhcp-pool-size single-source-of-truth file and all associated
Rust/Nix dual-constant plumbing are gone — there is no static map.
bridge_gateway_ip() is retained (still needed for HOST_ADDRESS).

Closes #2363

hive-sh4re/src/priv_proto.rs

@@ -208,21 +208,21 @@ pub struct CredentialMount {
 
 /// Network isolation parameters for `WriteNspawnFlags`. When `Some`,
 /// hive-priv writes `PRIVATE_NETWORK=1` + veth bridge wiring instead
-/// of the default `PRIVATE_NETWORK=0`.
+/// of the default `PRIVATE_NETWORK=0`. Containers receive their IP
+/// dynamically via DHCP from the bridge dnsmasq pool (`networking.useDHCP`
+/// in `harness-base.nix`); no static address is pre-assigned here.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct NetworkIsolation {
-    /// Static IP address to assign to this container on the bridge subnet.
-    pub agent_ip: String,
     /// Host bridge interface name (e.g. `hive0`).
     pub bridge: String,
     /// Bridge gateway IP (the host-side bridge address, e.g. `10.42.0.1`).
     /// Written as `HOST_ADDRESS=` in the nspawn conf so nixos-container's
-    /// container-side setup installs a default route (`default via <gw>`):
-    /// without it the container comes up with an address but no route off
-    /// the bridge subnet — no internet, no `api.anthropic.com`. The same IP
-    /// runs the hive dnsmasq resolver, so it's also written into the
-    /// container's `/etc/resolv.conf` (see the isolated-DNS oneshot in
-    /// `harness-base.nix`, gated on the marker hive-priv drops).
+    /// container-side setup installs a default route (`default via <gw>`)
+    /// before DHCP completes: without it the container has no route off
+    /// the bridge subnet until the DHCP lease arrives. The same IP runs the
+    /// hive dnsmasq resolver, so it's also written into the container's
+    /// `/etc/resolv.conf` (see the isolated-DNS oneshot in `harness-base.nix`,
+    /// gated on the marker hive-priv drops).
     pub gateway_ip: String,
 }