docs: repoint agent-tier option paths to services.hyperhive.agent.*

Refs #4479

docs/agent-lifecycle/agent-hierarchy.md

@@ -194,7 +194,7 @@ direct mentions, reviews, and assignments.
   session dir.
 - `HIVE_STATIC_DIR = <mergedDist>` — `tower_http::ServeDir` root for
   the per-agent web UI; merged dist = agent default + every
-  `hyperhive.frontend.extraFiles` overlay.
+  `services.hyperhive.agent.frontend.extraFiles` overlay.
 - `HIVE_ASSETS_DIR = pkgs.hyperhive-assets/share/hyperhive` — set
   directly on the unit, **not** via `environment.variables`, because
   the latter only populates `/etc/profile` which systemd services
@@ -213,7 +213,7 @@ wrappers — notably `sudo` — resolve before bare nix-store binaries; see
 general. It's load-bearing here because the harness runs as the
 per-agent user: without the wrapper dir on `PATH`, `sudo` resolves to
 the non-setuid nix-store binary and every
-`hyperhive.user.passwordlessSudo` grant fails with "must be owned by
+`services.hyperhive.agent.user.passwordlessSudo` grant fails with "must be owned by
 uid 0 and have the setuid bit set."
 
 ### `serviceConfig` highlights
@@ -229,7 +229,7 @@ uid 0 and have the setuid bit set."
   the host bind-mounts in root-owned and which holds hive-c0re's
   `mcp.sock`.
 - `User = Group = userName` — drops root inside the container; sudo is
-  the explicit escalation surface (`hyperhive.user.passwordlessSudo`).
+  the explicit escalation surface (`services.hyperhive.agent.user.passwordlessSudo`).
 
 ## Cross-references