per-agent extra MCP servers via hyperhive.extraMcpServers

new NixOS option in harness-base.nix:
  hyperhive.extraMcpServers.<key> = {
    command = "/path/to/server";
    args = [ ... ];
    env = { KEY = "value"; };
    allowedTools = [ "send_message" "join_room" ];  # or ["*"]
  };

declared as attrsOf submodule so agents stack arbitrarily many.
the module writes the whole map as JSON to
/etc/hyperhive/extra-mcp.json at activation; the harness reads
that file in mcp::render_claude_config and merges each entry
into the rendered --mcp-config under its own mcpServers.<key>
block. allowed_mcp_tools(flavor) extends the --allowedTools
arg with mcp__<key>__<pattern> for every entry — "*" (the
default) becomes mcp__<key>__* so every tool from that server
is auto-approved, or pass a concrete list to tighten.

collision guard: an extra server keyed "hyperhive" is dropped
with a warn-log so user config can't shadow the built-in
surface. malformed JSON / missing file fall back to "no
extras" silently.

prompt note added: agents see "(some agents only) extra MCP
tools surfaced as mcp__<server>__<tool>" and learn they're
declared via agent.nix. retires the matching TODO under
Per-agent extension. matrix-chat agents + bitburner-agent
migration unblocked.

TODO.md

@@ -47,21 +47,6 @@ Pick anything from here when relevant. Cross-cutting design notes live in
   claude-code's `--allowedTools` extended grammar. Likely lives in
   `agent.nix` so each agent can scope its own shell surface.
 
-## Per-agent extension
-
-- **Custom per-agent MCP tools.** Today every sub-agent gets the
-  same fixed MCP surface (`send`, `recv`). To move bitburner-agent
-  (and anything else with rich domain tooling) into hyperhive, an
-  agent needs a way to ship its own tools alongside hyperhive's.
-  Sketch: `agent.nix` declares a list of extra MCP servers
-  (command + args + env), each registered into the agent's
-  `--mcp-config` blob at flake-render time. The harness MCP server
-  remains the hyperhive surface; new servers slot in as additional
-  entries under `mcpServers.<name>` so claude sees them as
-  `mcp__<name>__<tool>`. Per-agent tool whitelist (`allowedTools`)
-  derived from the same config so the operator stays in control of
-  what's exposed.
-
 ## Operational hygiene (post-meta-flake)
 
 - **Tag retention.** Every approval mints up to 5 tags in