refactor: replace deprecated no-op options with mkRemovedOptionModule

nix/templates/harness/default.nix

@@ -34,19 +34,16 @@
     ./packages.nix
     ./user.nix
     ./weston-vnc.nix
+    (lib.mkRemovedOptionModule [ "hyperhive" "web" "useUnixSocket" ] ''
+      Unix socket mode is always enabled for all agents. Remove the
+      setting from your agent.nix.
+    '')
+    (lib.mkRemovedOptionModule [ "hyperhive" "allowedBashPatterns" ] ''
+      The built-in Bash tool is fully disabled; agents use
+      mcp__bash__run instead. Remove the setting from your agent.nix.
+    '')
   ];
 
-  options.hyperhive.web.useUnixSocket = lib.mkOption {
-    type = lib.types.bool;
-    default = false;
-    example = true;
-    description = ''
-      Deprecated. Unix socket mode is now always enabled for all agents.
-      Setting this option to `true` has no effect and the option will be
-      removed in a future version. Safe to drop from agent configs.
-    '';
-  };
-
   options.hyperhive.icon = lib.mkOption {
     type = lib.types.nullOr lib.types.path;
     default = null;