agents: drop root, run as per-agent unix user with passwordless sudo (#658)

nix/templates/manager.nix

@@ -1,4 +1,7 @@
 { pkgs, config, ... }:
+let
+  userName = config.hyperhive.user.name;
+in
 {
   imports = [ ./harness-base.nix ];
 
@@ -24,6 +27,9 @@
       HIVE_PORT = "8000";
       HIVE_LABEL = "hm1nd";
       SHELL = "${pkgs.bashInteractive}/bin/bash";
+      # `HOME` set explicitly so claude finds `~/.claude/` at the
+      # bind-mounted location after #658 (User= drop from root).
+      HOME = "/home/${userName}";
       # Manager runs the same hive-m1nd harness binary that serves
       # the per-agent web UI; point it at the merged agent static dist
       # (same shape as for sub-agents).
@@ -42,6 +48,13 @@
       ExecStart = "${pkgs.hyperhive}/bin/hive-m1nd serve";
       Restart = "on-failure";
       RestartSec = 2;
+      # Same drop-from-root as agent-base.nix (#658). Manager
+      # interactions with the host (rebuild approvals, config
+      # writes) still happen via the dedicated unix sockets
+      # bind-mounted from hive-c0re — those don't need root
+      # inside the container.
+      User = userName;
+      Group = userName;
     };
   };
 }