docs: repoint agent-tier option paths to services.hyperhive.agent.*

Refs #4479

docs/turn-loop/config.md

@@ -5,10 +5,10 @@ Optional per-agent knobs, set under `hyperhive.*` in the agent's own
 Absent means the default. (The claude spawn + compaction themselves live in
 [claude-invocation](claude-invocation.md).)
 
-## Reference docs (`hyperhive.docs.enable`)
+## Reference docs (`services.hyperhive.agent.docs.enable`)
 
 ```nix
-hyperhive.docs.enable = true;  # default: false (true for the manager agent)
+services.hyperhive.agent.docs.enable = true;  # default: false (true for the manager agent)
 ```
 
 Makes the hyperhive `docs/` tree available inside the container at a nix
@@ -27,7 +27,7 @@ that input — not every agent's container gets rebuilt on a doc-only change.
 ## Agent icon
 
 ```nix
-hyperhive.icon = ./icon.svg;  # default: null (falls back to shared hyperhive logo)
+services.hyperhive.agent.icon = ./icon.svg;  # default: null (falls back to shared hyperhive logo)
 ```
 
 Path to an SVG file used as this agent's visual identity — shown in
@@ -44,7 +44,7 @@ at `GET /icon` on the per-agent web port.
 ## `user.passwordlessSudo`
 
 ```nix
-hyperhive.user.passwordlessSudo = true;  # default
+services.hyperhive.agent.user.passwordlessSudo = true;  # default
 ```
 
 Grants the per-agent unix user passwordless `sudo` (`NOPASSWD: ALL`).
@@ -57,15 +57,15 @@ Set to `false` for agents that should be strictly unprivileged.
 Any tool invocation that needs root then fails loudly with the standard
 sudo rejection rather than silently succeeding — easier to audit.
 
-`hyperhive.user.uid`, `hyperhive.user.gid`, and
-`hyperhive.user.name` are the companion options; see
+`services.hyperhive.agent.user.uid`, `services.hyperhive.agent.user.gid`, and
+`services.hyperhive.agent.user.name` are the companion options; see
 `docs/agent-lifecycle/agent-hierarchy.md` — "Harness systemd unit shape" for the full
 `user.*` surface.
 
 ## Dashboard links
 
 ```nix
-hyperhive.dashboardLinks = [
+services.hyperhive.agent.dashboardLinks = [
   { label = "Stats"; icon = "📊"; url = "http://localhost:9001/stats"; }
   { label = "Scratchpad"; url = "http://localhost:8080"; }
 ];
@@ -92,7 +92,7 @@ Omitting the option (default empty) produces no extra links.
 ## Custom static files
 
 ```nix
-hyperhive.frontend.extraFiles = {
+services.hyperhive.agent.frontend.extraFiles = {
   "games/bitburner" = {
     source = ./bitburner-dist;   # path relative to agent.nix
     # target defaults to attribute name: "games/bitburner"
@@ -121,23 +121,23 @@ rejects `..` segments. The merge step refuses to overwrite
 files already present in the default dist — pick a target name that
 doesn't collide with existing paths (`static/`, `index.html`, etc.).
 
-The default dist ships at `hyperhive.frontend.dist` (the
+The default dist ships at `services.hyperhive.agent.frontend.dist` (the
 `hyperhive-frontend` package output, read-only). To replace the
 entire UI rather than layer on top, override `frontend.dist` directly.
 
 ## Connectivity overrides
 
-Two `hyperhive.forge.*` / `hyperhive.matrix.*` options override where
+Two `services.hyperhive.agent.forge.*` / `services.hyperhive.agent.matrix.*` options override where
 the per-agent daemons connect. Both rarely need changing on a standard
 single-host deploy, but are useful for multi-hive or custom-network
 setups.
 
 ```nix
-hyperhive.forge.url = "http://forge.example:3000";  # default: null
-hyperhive.matrix.url = "https://matrix.example";    # default: null
+services.hyperhive.agent.forge.url = "http://forge.example:3000";  # default: null
+services.hyperhive.agent.matrix.url = "https://matrix.example";    # default: null
 ```
 
-**`hyperhive.forge.url`** — base URL of the Forgejo instance. Used by
+**`services.hyperhive.agent.forge.url`** — base URL of the Forgejo instance. Used by
 a one-shot boot unit (`tea-login`) that writes `~/.config/tea/config.yml`
 directly from the agent's `forge-token`, so `tea` and `hive-forge`
 work without an interactive auth step. The unit is a no-op when
@@ -156,7 +156,7 @@ host's real forge URL into every agent, and refuses to write a meta
 flake without one, so `null` only survives where nix evaluates the
 agent modules outside a hive.
 
-**`hyperhive.matrix.url`** — homeserver URL used by
+**`services.hyperhive.agent.matrix.url`** — homeserver URL used by
 `hive-matrix-daemon` when connecting via the matrix-sdk. hive-c0re
 writes it into every agent at deploy time as the gateway-routed
 `chat.<swarm-domain>` URL, so isolated agents can reach the homeserver.
@@ -179,15 +179,15 @@ The harness installs Claude Code plugins before the serve loop opens.
 Three per-agent `agent.nix` options control this:
 
 ```nix
-hyperhive.claudeMarketplaces = [                        # default
+services.hyperhive.agent.claudeMarketplaces = [                        # default
   "anthropics/claude-plugins-official"
-  "${hyperhive.packages.claude-plugins}"                # hive's own local marketplace, registered as `hyperhive`
+  "${services.hyperhive.agent.packages.claude-plugins}"                # hive's own local marketplace, registered as `hyperhive`
 ];
-hyperhive.claudePlugins = [                              # default
+services.hyperhive.agent.claudePlugins = [                              # default
   "skill-creator@claude-plugins-official"
   "base@hyperhive"
 ];
-hyperhive.claudePluginsAutoUpdate = false;               # default
+services.hyperhive.agent.claudePluginsAutoUpdate = false;               # default
 ```
 
 - **`claudeMarketplaces`** — list of marketplace sources passed to
@@ -222,7 +222,7 @@ hyperhive.claudePluginsAutoUpdate = false;               # default
 ## `cargo.shortMessages`
 
 ```nix
-hyperhive.cargo.shortMessages = true;  # default
+services.hyperhive.agent.cargo.shortMessages = true;  # default
 ```
 
 When enabled (the default), the harness injects a `cargo` shell
@@ -243,10 +243,10 @@ programmatically and don't pass `--message-format json` themselves.
 ## API-key provider (`useApiKey` / `backendEnvironmentFile`)
 
 ```nix
-hyperhive.useApiKey = true;               # default: false
-hyperhive.backendEnvironmentFile =
+services.hyperhive.agent.useApiKey = true;               # default: false
+services.hyperhive.agent.backendEnvironmentFile =
   "/agents/myagent/harness/openrouter.env"; # default: null
-hyperhive.model = "anthropic/claude-3.5-sonnet"; # provider-specific model string
+services.hyperhive.agent.model = "anthropic/claude-3.5-sonnet"; # provider-specific model string
 ```
 
 Runs this agent's `claude` against an API-key provider (for example OpenRouter)