docs: repoint agent-tier option paths to services.hyperhive.agent.*

Refs #4479

docs/turn-loop/claude-invocation.md

@@ -42,7 +42,7 @@ deliberately not in that file — the `--effort` flag
 live, which managed scope would otherwise lock.
 
 The harness reads `<name>` from `Bus::model()` on each turn.
-`hyperhive.model` in the agent's `agent.nix` sets the initial
+`services.hyperhive.agent.model` in the agent's `agent.nix` sets the initial
 default (NixOS option; propagates via `HIVE_DEFAULT_MODEL` env var; falls
 back to `"haiku"` if unset). The operator can flip it at runtime
 with `/model <name>` in the web terminal — the next turn picks it
@@ -146,7 +146,7 @@ deliberately _not_ the primary mechanism — it runs with no checkpoint and
 none of the `CHECKPOINT_PROMPT` notes-flush machinery above, so a session
 saved by it still loses whatever wasn't already durable — but it can act
 _mid-turn_, underneath `InfiniteSession::run`, which the two triggers above
-structurally can't. Don't confuse this with the `hyperhive.autoCompact`
+structurally can't. Don't confuse this with the `services.hyperhive.agent.autoCompact`
 nix option below: that one is a per-agent on/off for hyperhive's _own_
 proactive watermark and has no effect on claude's native mechanism, which
 is fleet-wide and set once in `hive-agent/prompts/claude-settings.json`.
@@ -171,7 +171,7 @@ a live claude process.
 To disable proactive compaction for a specific agent, use the nix option:
 
 ```nix
-hyperhive.autoCompact = false;  # default true
+services.hyperhive.agent.autoCompact = false;  # default true
 ```
 
 Setting `autoCompact = false` sets `HIVE_COMPACT_WATERMARK_TOKENS=0`, which
@@ -228,7 +228,7 @@ needs to `chown` a bind mount), once at startup:
 
 - `claude-mcp-config.json` — points claude at the persistent
   `hive-mcp-http` daemon (`http://127.0.0.1:{port}/mcp`, port from
-  `hyperhive.mcp.httpPort`, default 8790) for the built-in `hyperhive`
+  `services.hyperhive.agent.mcp.httpPort`, default 8790) for the built-in `hyperhive`
   surface. HTTP is the sole transport for it — no per-turn stdio child,
   so the URL survives the per-turn claude re-spawn (no re-registration
   race), trading that for a hard dependency on the daemon's uptime
@@ -241,11 +241,11 @@ needs to `chown` a bind mount), once at startup:
   substituted: `{label}` (short agent name), `{qualified_label}`
   (hive-qualified `name@domain` form), `{operator_pronouns}`,
   `{hive_identity}` (for example `` on hive `pr1ma` ``; empty when
-  `hyperhive.hiveName` is unset), and `{swarm_identity}` (same
+  `services.hyperhive.agent.hiveName` is unset), and `{swarm_identity}` (same
   shape for the swarm). Pronouns come from `HIVE_OPERATOR_PRONOUNS`
   env (set by the meta flake from
   `services.hyperhive.c0re.operatorPronouns`, default `she/her`).
-  When `hyperhive.docs.enable` is set, `HIVE_DOCS_DIR` is present
+  When `services.hyperhive.agent.docs.enable` is set, `HIVE_DOCS_DIR` is present
   in the environment and `render()` appends a one-sentence pointer
   telling the agent the docs are mounted at that path.
   Passed via `--system-prompt-file`.