docs sync + revert auto-unfree removal

revert the earlier 'operator must set allowUnfree' move:
per-agent containers evaluate their own nixpkgs and the operator's
host-level allowUnfree doesn't propagate in. restoring the scoped
allowUnfreePredicate inside both the claude-unstable overlay and
harness-base.nix; documented in README + gotchas as 'nothing to
set on the operator side'.

docs:
- claude.md file map adds crash_watch.rs, kick_agent on coordinator,
  /api/model + journald viewer + bind-with-retry references.
- scratchpad rewritten to reflect the recent run.
- web-ui.md: notification row + browser notifications section,
  state row (badge + model chip + last-turn chip + cancel button),
  per-agent inbox, /model slash, /cancel-question + journald
  endpoints, focus-preservation on refresh.
- turn-loop.md: --model is read from Bus::model() per turn (runtime
  override via /model); recv(wait_seconds) up to 180s with the
  rationale; ask_operator gains ttl_seconds; new TurnState section;
  kick_agent inbox-on-startup hint.
- approvals.md: ttl/cancel resolution paths for operator questions.
- persistence.md: /state/hyperhive-model file.
- gotchas.md: web UI port collision policy (rename, don't probe);
  bind retry + SO_REUSEADDR shape; auto-unfree restored.
- todo.md: cleaned up empty sections and stale entries; /model
  shipped, dropped from the list.

TODO.md

@@ -44,11 +44,6 @@ Pick anything from here when relevant. Cross-cutting design notes live in
 
 ## UI / UX
 
-
-- **Terminal: `/model` slash command.** Operator-typeable model
-  override from the terminal. Depends on the model-override work
-  above; once an override mechanism exists, wire a `/model <name>`
-  command that POSTs to a new endpoint.
 - **xterm.js terminal** embedded per-agent, attached to a PTY exposed by
   the harness. Pairs well with the unprivileged-container work — would let
   the operator drop into the container without `nixos-container root-login`.
@@ -71,9 +66,6 @@ Pick anything from here when relevant. Cross-cutting design notes live in
   the harness on `TurnEnd`; `GET /api/stats?since=…` returns the
   series; agent page renders with a small chart lib (uPlot is light).
 
-## Manager → operator question channel
-
-
 ## Spawn flow
 
 - **Two-step spawn.** Today `request_spawn(name)` is one shot: manager
@@ -101,4 +93,3 @@ Pick anything from here when relevant. Cross-cutting design notes live in
   grow. Bitburner-agent's pattern: a short-lived secondary claude session
   that takes the existing notes + a "compact this" prompt and rewrites
   them in place. Add when the notes start bloating.
-