docs: nixpkgs-override guidance in README, fix stale CLAUDE.md repo map

README: add a "Overriding nixpkgs" section explaining hyperhive.inputs.
nixpkgs.follows and showing it in the quick-start flake example, since
hyperhive pins its own nixpkgs and consumers embedding it as a flake
input generally want to follow their host's nixpkgs instead.

CLAUDE.md: the repo map still described a hive-ag3nt/ directory
grouping hive-agent, hive-agent-mcp, and hive-agent-wake — that
directory doesn't exist; they're three separate top-level crates.
Also added the three wire-type crates split out of hive-sh4re
(hive-host-sock, hive-priv-sock) and hive-metric, none of which were
listed.

CLAUDE.md

@@ -38,13 +38,18 @@ hand-maintained per-file tree drifts out of sync with the code.
   destroy|rebuild|restart|list|set-parent|…>`, `approvals <pending|
   approve|deny>`, `forge`/`matrix`/`github`/`gateway` provisioning,
   `choom`, `stop`/`start`, `wg`/`peer-config`.
-- **`hive-ag3nt/`** — in-container harness; three sibling binaries for
-  every agent (`hive-agent` serve loop, `hive-agent-mcp`,
-  `hive-agent-wake`). Turn-loop *policy* layer (`turn.rs`) over the `hive-claude`
-  driver, embedded MCP server (`mcp.rs`) + its claude launch-config layer
-  (`mcp_config.rs`: tool-group/capability → `--allowedTools`, `--mcp-config`
-  render), per-agent web UI (`web_ui/` module dir), event + turn-stats
-  sqlite sinks, login flow, system-prompt renderer, forge-notify subscriber.
+- **`hive-agent/`**, **`hive-agent-mcp/`**, **`hive-agent-wake/`** —
+  in-container harness, three sibling crates for every agent (not a
+  single `hive-ag3nt/` dir — that's the runtime/binary-family nickname,
+  not a directory). `hive-agent` is the serve-loop binary: turn-loop
+  *policy* layer (`turn.rs`) over the `hive-claude` driver, per-agent web
+  UI (`web_ui/` module dir), event + turn-stats sqlite sinks, login flow,
+  system-prompt renderer, forge-notify subscriber. `hive-agent-mcp` is
+  the embedded MCP server (long-lived streamable-http listener,
+  `hive-mcp-http` systemd unit) + its claude launch-config layer
+  (tool-group/capability → `--allowedTools`, `--mcp-config` render).
+  `hive-agent-wake` is a small external wake CLI for extra MCP
+  servers/helpers to nudge claude on external events.
 - **`hive-claude/`** — reusable, app-agnostic driver for headless
   `claude --print`: spawns the CLI, streams + classifies stream-json,
   parses per-turn `Telemetry`, and drives a durable self-compacting
@@ -62,9 +67,20 @@ hand-maintained per-file tree drifts out of sync with the code.
 - **`hive-bash-mcp/`** — per-agent bash-task runner daemon plus its
   stdio MCP bridge; writes task files under `/harness/bash-tasks/` and
   the favorite-tools `bash_commands` stat into turn-stats.sqlite.
-- **`hive-sh4re/`** — shared wire types (Host / Agent / Manager request
-  + response, `Message`, `Approval`, `HelperEvent`) used across the
-  unix sockets.
+- **`hive-sh4re/`** — shared wire types (Agent / Manager request +
+  response, `Message`, `Approval`, `HelperEvent`) used across the unix
+  sockets. Host-admin-socket and hive-priv-socket wire types have been
+  split out into their own crates (below) so `hivectl` and `hive-priv`
+  don't need to pull in the rest of `hive-sh4re`.
+- **`hive-host-sock/`** — wire types for the host admin socket
+  (`/run/hyperhive/host.sock`), the protocol `hivectl` speaks to
+  `hive-c0re`. Split out of `hive-sh4re` so a standalone `hivectl` only
+  depends on this protocol crate, not the whole daemon crate.
+- **`hive-priv-sock/`** — wire types for the `hive-priv` privileged-helper
+  socket (`/run/hive/priv.sock`), shared by `hive-priv` (server) and
+  `hive-c0re` (client). Also split out of `hive-sh4re`.
+- **`hive-metric/`** — small CLI to push a single labeled metric to the
+  OTEL collector via the OpenTelemetry Rust SDK / OTLP HTTP exporter.
 
 ### Other top-level dirs