docs: repoint agent-tier option paths to services.hyperhive.agent.*

Refs #4479

docs/turn-loop/mcp.md

@@ -2,13 +2,13 @@
 
 The harness ships an embedded MCP server (rmcp 2). A persistent
 `hive-mcp-http` daemon serves the built-in `hyperhive` surface over
-streamable HTTP (loopback, `127.0.0.1:<hyperhive.mcp.httpPort>`,
+streamable HTTP (loopback, `127.0.0.1:<services.hyperhive.agent.mcp.httpPort>`,
 per-container private netns). Claude connects to its stable URL via
 `--mcp-config` rather than respawning a stdio child each turn, so the
 URL survives the per-turn claude re-spawn (and a host-side hive-c0re
 restart) — there is no per-turn MCP re-registration race for the
 built-in surface. HTTP is the sole transport for it (no stdio fallback).
-Extra servers (`hyperhive.extraMcpServers`) pick their own transport per
+Extra servers (`services.hyperhive.agent.extraMcpServers`) pick their own transport per
 entry (`type = "stdio" | "http"`, default `"stdio"`): `matrix` stays a
 stdio bridge, `bash` runs its own persistent streamable-http listener
 (`hive-bash-daemon`) — same reasoning as the built-in surface. The
@@ -33,7 +33,7 @@ preset (`AGENT_DEFAULT`) includes `messaging`, `meta`, `inbox`, and
   parent without hardcoding the label; the broker resolves the
   sentinel at delivery time. Optional `in_reply_to: i64` links the
   message to a prior id for thread rendering. Per-agent
-  `hyperhive.allowedRecipients` (default: empty = unrestricted) limits
+  `services.hyperhive.agent.allowedRecipients` (default: empty = unrestricted) limits
   which names `send` accepts — useful for sandboxing: set
   `[ "operator" ]` to restrict a sub-agent to operator messages only
   (the topology parent is always reachable regardless of this list —