docs: address mara review on #1936

- Drop the redundant 'including the root/bootstrap container' /
  'sub-agents + root' enumerations in the port-range + state-dir
  uniformity statements — 'every agent' / 'all agents' is enough (and
  calling out '+ root' reintroduces the special-case framing).
- Stop describing the root agent's privileged (manager-flavour) socket
  as a current thing (it's being removed): drop the conventions.md
  capability clause, the network.md per-agent-privileged-socket list
  entry, and the persistence.md /run/hyperhive/manager/mcp.sock
  runtime-dir bullet.

docs/network.md

@@ -130,7 +130,7 @@ address arithmetic.
 `lifecycle::set_nspawn_flags` when creating or updating containers. Each
 agent gets a deterministic IP derived from its name so the address is
 reproducible across destroy/recreate. This applies uniformly to all
-containers including the root/bootstrap container — no special case.
+containers — no special case.
 
 `HOST_ADDRESS` is the bridge gateway IP (the address part of
 `HIVE_NETWORK_SUBNET`, via `lifecycle::bridge_gateway_ip` — taken verbatim
@@ -163,9 +163,9 @@ wiring is runtime:
   an instant no-op in shared-netns mode (the marker is absent, so
   `ConditionPathExists` skips it).
 
-**Why isolation is safe for the root agent**: all hive-c0re communication goes
+**Why isolation is safe**: all hive-c0re communication goes
 through unix domain sockets (`/run/hive/mcp.sock` for agent requests,
-`/run/hive/priv.sock` for privileged ops, per-agent privileged sockets).
+`/run/hive/priv.sock` for privileged ops).
 These are bind-mounted into containers via the nspawn conf. UDS paths
 traverse the VFS, not the network stack, so `PRIVATE_NETWORK=1` does not
 affect them.