hive-c0re: render the new agent option paths into generated agent flakes

meta.rs writes each agent's flake, and it still named the pre-move
`hyperhive.*` paths — so every agent rebuild would print a rename
deprecation warning about a line no human wrote and no operator could fix.
A warning nobody can act on trains everyone to ignore the ones that matter,
which is the whole value of the alias shims.

Repoints the FORWARDED_VAR_OPTIONS table and every other emitted option
assignment (otel.*, docs.source, claudeCodePath, github.enable, user.name,
claudeMemoryMaxBytes) to `services.hyperhive.agent.*`, with the test
expectations that pin the rendered text. The flake input named `hyperhive`
(`hyperhive.url`, `hyperhive.inputs.nixpkgs.follows`,
`hyperhive.nixosConfigurations.*`), hive-tier `services.hyperhive.*` paths,
and the `@hyperhive.local` git identity share the word and are untouched.

Also repoints the same option paths where they appear in comments, rustdoc
and runtime message strings across the other crates — a refusal message
naming `hyperhive.allowedRecipients` sends an operator to a path that will
stop existing. Prose under docs/ is deliberately not in this commit.

Refs #4473

hive-agent-mcp/src/mcp/mod.rs

@@ -150,7 +150,7 @@ impl AgentServer {
     async fn send(&self, Parameters(args): Parameters<SendArgs>) -> String {
         let log = format!("{args:?}");
         let to = args.to.clone();
-        // Check per-agent allow-list (hyperhive.allowedRecipients). When no
+        // Check per-agent allow-list (services.hyperhive.agent.allowedRecipients). When no
         // policy file is present (e.g. manager containers) the check is a no-op.
         if let Err(refusal) = crate::send_allow::check_send_allowed(&to) {
             return run_tool_envelope("send", log, async move { refusal }).await;

hive-agent-mcp/src/mcp/render.rs

@@ -318,7 +318,7 @@ pub(super) struct MatrixRoomUnread {
 }
 
 /// Default port `hive-matrix-daemon` serves its MCP + status endpoints
-/// on (`hyperhive.mcp.matrixHttpPort`'s nix default). Overridable via
+/// on (`services.hyperhive.agent.mcp.matrixHttpPort`'s nix default). Overridable via
 /// `HIVE_MATRIX_HTTP_PORT` for parity with the port options nix already
 /// exposes; unset in practice since a single fixed port is safe (each
 /// agent container is its own network namespace — see docs/networking/network.md).

hive-agent-mcp/src/send_allow.rs

@@ -49,7 +49,7 @@ pub fn check_send_allowed(to: &str) -> Result<(), String> {
         return Ok(());
     }
     Err(format!(
-        "send refused: recipient '{to}' not in hyperhive.allowedRecipients \
+        "send refused: recipient '{to}' not in services.hyperhive.agent.allowedRecipients \
          (configured in agent.nix). Allowed: {allow:?}. Your structural \
          parent is always reachable — route through `send(to: \"{}\", …)` \
          if you need to reach someone outside the allow-list.",