docs: repoint agent-tier option paths to services.hyperhive.agent.*

Refs #4479

docs/process/conventions.md

@@ -523,7 +523,7 @@ the state dir at provisioning time:
   `forge-token` written by `hive-c0re::forge::ensure_user_for`,
   so `tea repos create` / `tea pulls create` work without
   interactive prompts.
-- `forge-avatar-sync` — uploads `hyperhive.icon` SVG to the
+- `forge-avatar-sync` — uploads `services.hyperhive.agent.icon` SVG to the
   agent's Forgejo profile, so the icon shows up on commits / PRs /
   issue comments.
 

docs/process/gotchas.md

@@ -135,7 +135,7 @@ agent's flake as a string literal and the agent module symlinks
 `path:/nix/store/<pkg>` flake input is re-copied into the store as a
 reference-less `-source` (so the runtime closure never arrives), and
 `lib.types.package` fed a bare path runs `builtins.storePath`, which
-pure evaluation rejects. `hyperhive.docs.source` gets away with being
+pure evaluation rejects. `services.hyperhive.agent.docs.source` gets away with being
 an input only because a docs tree has no runtime dependencies.
 
 The `storePath` trap is worth spelling out, because it's not confined
@@ -366,15 +366,15 @@ Never use raw `curl` for forge access.
 
 ## GUI (weston/VNC)
 
-### Weston VNC compositor (per-agent `hyperhive.gui.enable`)
+### Weston VNC compositor (per-agent `services.hyperhive.agent.gui.enable`)
 
 `nix/agent-modules/weston-vnc.nix` adds an optional Weston Wayland
 compositor with the `vnc-backend` plugin, surfaced as
-`hyperhive.gui.enable = true` per-agent. The harness's
+`services.hyperhive.agent.gui.enable = true` per-agent. The harness's
 `/screen/ws` WebSocket relay (`docs/web-ui/agent.md::Per-agent endpoints`)
 connects to the compositor at `127.0.0.1:<vnc_port>`.
 
-- **Port allocation**: a **fixed** port (`hyperhive.gui.vncPort`,
+- **Port allocation**: a **fixed** port (`services.hyperhive.agent.gui.vncPort`,
   default 5900). No per-agent hashing: network isolation is
   unconditional (each agent has its own netns — see
   `docs/networking/network.md#container-isolation`), so the VNC port is
@@ -384,7 +384,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
   the agent **web-UI** port, which is still an FNV-1a hash because those
   listen on the shared host stack — see `Web UI ports collide on hash`.)
 - **Non-root, shared user session**: weston runs as the agent's own
-  user (`hyperhive.user.name`, the same user hive-ag3nt runs as), not
+  user (`services.hyperhive.agent.user.name`, the same user hive-ag3nt runs as), not
   root, so the GUI and the agent share one session. The runtime dir is a
   fixed `/run/gui` (systemd `RuntimeDirectory=gui`, `0700`,
   `RuntimeDirectoryPreserve=yes` so it survives weston restarts for the
@@ -407,7 +407,7 @@ connects to the compositor at `127.0.0.1:<vnc_port>`.
   launched with `--socket=wayland-0` so the socket path is
   deterministic. `nix/agent-modules/weston-vnc.nix` exports `WAYLAND_DISPLAY=wayland-0`
   and `XDG_RUNTIME_DIR=/run/gui` as global system environment
-  variables (gated on `hyperhive.gui.enable`) so every systemd service
+  variables (gated on `services.hyperhive.agent.gui.enable`) so every systemd service
   in the container inherits them. Without this, services starting
   Wayland clients couldn't find the compositor — libwayland falls
   back to a headless display or errors out, the app "works" on a
@@ -505,7 +505,7 @@ The fix (`nix/docs/default.nix`):
    context. The resulting store path is content-addressed from the nix/
    file contents only. Docs drvs only change when a `.nix` file changes.
 
-2. The package options the modules consume (`hyperhive.packages.*`,
+2. The package options the modules consume (`services.hyperhive.agent.packages.*`,
    `services.hyperhive.c0re.*`) carry no in-module defaults and every
    default that references them has a `defaultText`, so the doc walk
    never forces a package — no stubs needed, and the Rust/frontend