hive-c0re: render the new agent option paths into generated agent flakes

meta.rs writes each agent's flake, and it still named the pre-move
`hyperhive.*` paths — so every agent rebuild would print a rename
deprecation warning about a line no human wrote and no operator could fix.
A warning nobody can act on trains everyone to ignore the ones that matter,
which is the whole value of the alias shims.

Repoints the FORWARDED_VAR_OPTIONS table and every other emitted option
assignment (otel.*, docs.source, claudeCodePath, github.enable, user.name,
claudeMemoryMaxBytes) to `services.hyperhive.agent.*`, with the test
expectations that pin the rendered text. The flake input named `hyperhive`
(`hyperhive.url`, `hyperhive.inputs.nixpkgs.follows`,
`hyperhive.nixosConfigurations.*`), hive-tier `services.hyperhive.*` paths,
and the `@hyperhive.local` git identity share the word and are untouched.

Also repoints the same option paths where they appear in comments, rustdoc
and runtime message strings across the other crates — a refusal message
naming `hyperhive.allowedRecipients` sends an operator to a path that will
stop existing. Prose under docs/ is deliberately not in this commit.

Refs #4473

hive-agent/src/plugins.rs

@@ -1,5 +1,5 @@
 //! Boot-time `claude plugin install` driver. Reads the list declared
-//! via the `hyperhive.claudePlugins` NixOS option (rendered to
+//! via the `services.hyperhive.agent.claudePlugins` NixOS option (rendered to
 //! `/etc/hyperhive/claude-plugins.json` by the harness module) and
 //! shells out `claude plugin install <spec>` for each entry. Runs once
 //! per harness boot before the turn loop; `claude plugin install`
@@ -62,7 +62,7 @@ async fn add_marketplaces() {
     }
 }
 
-/// Read the `hyperhive.claudePluginsAutoUpdate` flag written by the NixOS
+/// Read the `services.hyperhive.agent.claudePluginsAutoUpdate` flag written by the NixOS
 /// module. Defaults to `false` when the file is absent or unparseable.
 async fn auto_update_enabled() -> bool {
     match tokio::fs::read_to_string(AUTO_UPDATE_PATH).await {