hive-c0re: grant hive-admin group a polkit rule for choom

nix/host-modules/hive-c0re/default.nix

@@ -229,6 +229,27 @@ in
       members = cfg.adminUsers;
     };
 
+    # Let `hive-admin` members run `hivectl agent <name> choom`
+    # (`machinectl shell`) without sudo, same opt-in-by-group shape as the
+    # socket grant above. `machinectl shell <name>@h-<name>` triggers exactly
+    # one polkit action, `org.freedesktop.machine1.shell` ("Acquire a shell
+    # in a local container") — not `.login` (a different verb, `machinectl
+    # login`, which `choom` never calls) and not `.host-shell` (the
+    # host-target variant, for a bare `machinectl shell` with no `@machine`
+    # suffix; `choom` always targets `<name>@h-<name>`). `enable = true` is
+    # required here: `security.polkit.extraConfig` is silently dropped
+    # unless the module itself is turned on, and nothing else in a headless
+    # hive pulls polkit in the way a desktop session would.
+    security.polkit.enable = true;
+    security.polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        if (action.id == "org.freedesktop.machine1.shell" &&
+            subject.isInGroup("hive-admin")) {
+          return polkit.Result.YES;
+        }
+      });
+    '';
+
     # The gateway nginx is always the sole external entry point (it runs
     # alongside hyperhive), so the per-agent web-port range stays closed on
     # the host firewall. See `docs/networking/gateway.md::Firewall posture (host-level)`.