agents: drop root, run as per-agent unix user with passwordless sudo (#658)

hive-ag3nt/src/login_session.rs

@@ -62,9 +62,11 @@ impl LoginSession {
             .stdin(Stdio::piped())
             .stdout(Stdio::piped())
             .stderr(Stdio::piped())
-            // `claude` reads $HOME for the credentials dir; the bind-mount
-            // puts it at /root/.claude, which is already the default home
-            // for uid 0 inside the container. Nothing extra to set here.
+            // `claude` reads $HOME/.claude for the credentials dir. The
+            // harness service env sets HOME to /home/<agent> (post-#658)
+            // and the bind-mount lands the OAuth dir at the same path,
+            // so the child inherits the right HOME without any further
+            // wiring here.
             .kill_on_drop(true)
             .spawn()
             .with_context(|| format!("spawn `{cmd}`"))?;