nix: add options docs outputs for host + agent surfaces (#616)

Auto-generate CommonMark references for hyperhive's two NixOS module
surfaces via `pkgs.nixosOptionsDoc`:

- `packages.<system>.docs-host` — operator-facing options exposed by
  `hyperhive.nixosModules.default` (`services.hive-c0re.*`,
  `hyperhive.domain`, `hyperhive.forge.*`, `hyperhive.matrix.*`).
- `packages.<system>.docs-agent` — per-agent options declared in
  `nix/templates/harness-base.nix` (model, allowedRecipients,
  extraMcpServers, frontend, forge, matrix, gui, …).
- `packages.<system>.docs` — both pages plus a thin `README.md`
  index, bundled for publishing.

Declaration links are rewritten to point at the forge source tree
instead of nix-store paths.

Host options come from a stubbed `nixosSystem` eval that force-disables
all hyperhive subsystems — only the *declarations* feed the doc
renderer, no heavy build inputs end up in the closure. Agent options
reuse `nixosConfigurations.agent-base.options` (already evaluated).

Also wired as `checks.<system>.docs` so CI fails fast on eval breakage.

flake.nix

@@ -115,6 +115,13 @@
           nativeBuildInputs,
           ...
         }:
+        let
+          docsAttrs = import ./nix/docs.nix {
+            inherit pkgs self;
+            inherit (nixpkgs) lib;
+            inherit (nixpkgs.lib) nixosSystem;
+          };
+        in
         {
           # Build the workspace binaries without running tests. Tests
           # are run as a separate check (`checks.cargo-test`) that
@@ -167,6 +174,15 @@
           # host would only succeed via a remote x86 builder.
           agent-base-toplevel = self.nixosConfigurations.agent-base.config.system.build.toplevel;
           manager-toplevel = self.nixosConfigurations.manager.config.system.build.toplevel;
+
+          # Auto-generated nix options reference for hyperhive (#616).
+          # `docs` bundles host + agent pages into one tree; the split
+          # outputs are useful when consumers only want one surface.
+          # All three are pure markdown — no rust or frontend deps in
+          # the closure, so `nix build .#docs` is cheap.
+          docs = docsAttrs.bundle;
+          docs-host = docsAttrs.host;
+          docs-agent = docsAttrs.agent;
         }
       );
 
@@ -328,6 +344,19 @@
             cargoTestExtraArgs = "--workspace";
             HIVE_ASSETS_DIR = "${self.packages.${system}.assets}/share/hyperhive";
           };
+          # Nix options docs evaluation (#616). Cheap: pulls in
+          # `nixosOptionsDoc` + the host module's stub eval, no rust or
+          # frontend deps. CI fails fast if a module change breaks
+          # option declarations or the doc rendering. `docs-host` +
+          # `docs-agent` are exposed as `packages` outputs (not checks)
+          # — they share this eval, so building the bundle here covers
+          # both surfaces in one shot.
+          docs =
+            (import ./nix/docs.nix {
+              inherit pkgs self;
+              inherit (nixpkgs) lib;
+              inherit (nixpkgs.lib) nixosSystem;
+            }).bundle;
         }
       );
     };