subagent daemon: throttle at two thirds of the container's memory

The daemon spawns every nested claude as a plain child, so its cgroup is
already the "all subagents" cgroup — but it ran with MemoryHigh=infinity
and MemoryMax=infinity, so nothing slowed a subagent down before the
kernel's OOM killer stopped the unit and cut every live session with it.

MemoryHigh= and not MemoryMax=: a soft ceiling reclaims and stalls the
cgroup past two thirds of the container's cap, which turns a silent kill
into a visible throttle, while still letting a single subagent exceed its
share when the container has memory free. A hard per-agent cap would make
overprovisioning impossible, which is not wanted — most of the time
nothing in these sessions is compiling.

The fraction is taken from hyperhive.claudeMemoryMaxBytes, the container's
own effective MemoryMax= that meta.rs already bakes in per agent. When
that is null (an `infinity` or percentage cap) the unit renders no ceiling
rather than a fabricated constant, and module-eval pins both arms.

Refs #4316

nix/agent-modules/claude-settings.nix

@@ -143,7 +143,10 @@ in
     description = ''
       Effective per-agent memory cap in bytes, when it's a plain
       byte-size value (null for an unbounded or percentage-based cap).
-      Used to derive `BUN_JSC_forceRAMSize` in `baseClaudeEnv`.
+      This is the whole container's cap, not claude's share of it —
+      the name records its first consumer, `BUN_JSC_forceRAMSize` in
+      `baseClaudeEnv`. `mcp.nix` reads it too, to size the subagent
+      daemon's `MemoryHigh=` against the container it runs in.
     '';
   };