docs: address mara review on #1936

- Drop the redundant 'including the root/bootstrap container' /
  'sub-agents + root' enumerations in the port-range + state-dir
  uniformity statements — 'every agent' / 'all agents' is enough (and
  calling out '+ root' reintroduces the special-case framing).
- Stop describing the root agent's privileged (manager-flavour) socket
  as a current thing (it's being removed): drop the conventions.md
  capability clause, the network.md per-agent-privileged-socket list
  entry, and the persistence.md /run/hyperhive/manager/mcp.sock
  runtime-dir bullet.

docs/conventions.md

@@ -10,7 +10,7 @@ exist because something already went wrong without them.
 - One agent is the bootstrap/root container, with a fixed name (`ruth` today).
 - `MAX_AGENT_NAME` in `lifecycle.rs` enforces the cap.
 - Per-agent web UI port = `WEB_PORT_BASE + FNV1a(name) % WEB_PORT_RANGE`
-  (8100..8999) for every agent including the bootstrap/root container; dashboard
+  (8100..8999) for every agent; dashboard
   `cfg.dashboardPort` (default 7000).
 
 ## Hive identity (label + domain + display names)
@@ -55,9 +55,8 @@ peer's name when the caller knows it's hive-local.
 
 There are no auth tokens on the per-agent unix sockets. The socket
 *path* identifies the principal; perms come from "who has the
-bind-mount." A sub-agent only sees its own `/run/hive/mcp.sock`; the
-root agent additionally has access to its privileged (manager-flavour)
-socket; hive-c0re owns the host admin socket.
+bind-mount." A sub-agent only sees its own `/run/hive/mcp.sock`;
+hive-c0re owns the host admin socket.
 
 ### Wake injection