agents: drop root, run as per-agent unix user with passwordless sudo (#658)

hive-c0re/src/meta.rs

@@ -401,6 +401,14 @@ where
           modules = [
             input.nixosModules.default
             {
+              # Drop root (#658): the harness service inside the
+              # container runs as a non-root unix user named after
+              # the agent (`damocles`, `iris`, `hm1nd`, …). UID
+              # auto-assigned by NixOS per mara on #658; the per-
+              # agent override here is what makes `hyperhive.user.name`
+              # match the agent's identity instead of the harness-
+              # base default of `"agent"`.
+              hyperhive.user.name = name;
               programs.git.config.user = {
                 name = name;
                 email = "${name}@hyperhive";