archetypes: build an archetype agent from its archetype's module on the hive

The hive reads the agent-archetype key when it provisions and rebuilds an
agent and keeps it in swarm-agent-archetypes.json. For an archetype agent
the meta flake has no agent-<name> input and mkAgent imports
hyperhive.hyperhiveArchetypes.<name>.module; provisioning, rebuilds, the
meta-input cascade, a deploy's rev and the startup migration skip the
config repos. The harness gets HIVE_ARCHETYPE and the system prompt says
the agent has no config repo. The create form sends the picked archetype.
Adds the android-dev built-in.

Refs #5386

docs/agent-lifecycle/agent-roster.md

@@ -106,13 +106,16 @@ state dirs work as for every other agent.
   deploy log). Any agent holding it gets the same mounts.
   The operator dashboard's `POST /api/meta-update` is the only path
   that writes `flake.lock`.
-- **Prompt** — identical for every container: `prompts/system.md`
+- **Prompt** — identical for every container but one block (below):
+  `prompts/system.md`
   carries `<!-- role:agent -->` / `<!-- role:manager -->` marker
   blocks, and `prompt::render` filters for `"agent"` unconditionally,
   manager included ("always `agent` role — there is only one role",
   `hive-agent/src/prompt.rs`'s own module doc). The `role:manager`
   blocks are dead in production, exercised only by a unit test
-  (`filter_role_blocks(SAMPLE, "manager")`).
+  (`filter_blocks(SAMPLE, "role", "manager")`). The one block that differs
+  is `<!-- config:repo -->` vs `<!-- config:archetype -->`: an agent built
+  from an [archetype](../swarm/archetypes.md) is told it has no config repo.
 - **Tool allow-list** — the MCP tools claude sees come from the agent's
   permissions alone, the same mechanism for every agent
   ([`docs/turn-loop/mcp.md`](../turn-loop/mcp.md)). Ruth's permissions

docs/agent-lifecycle/config-changes.md

@@ -65,6 +65,8 @@ Creating a brand-new agent is swarm-level (`swarmctl agent create`,
 an agent. The swarm controller's `InitAgentConfigRepo` job seeds the
 agent's config repo with a default `agent.nix` template, then asks the
 target hive to deploy it.
+An agent created from an [archetype](../swarm/archetypes.md) gets no
+config repo: its hive builds it from the archetype's module.
 
 Changing what the template seeded isn't a special case: like every
 later change, it's a PR on that config repo, made from a clone and

docs/agent-lifecycle/persistence.md

@@ -420,6 +420,12 @@ reads it at every container start for `manage_root_agent`. Each agent gets
 its own entry from it as `swarm-permissions.json` in its runtime dir, which
 it holds until its own first read of its key succeeds.
 
+`/var/lib/hyperhive/swarm-agent-archetypes.json` holds the archetype each of
+this hive's archetype agents runs, as last read from the swarm's
+`agent-archetype` bucket at the agent's provision and each rebuild. An agent
+with an entry has no `applied/<n>` repo and no `agent-<n>` meta input; see
+[archetypes](../swarm/archetypes.md).
+
 hive-c0re renders containers onto `meta#<n>` at creation.
 
 ## Destroy vs purge