hive-subagent-mcp: run an agent's subagents on its runtime

The subagent daemon now reads the parent agent's runtime at startup
(`hive_runtime::RuntimeSpec`, from the harness's `HIVE_RUNTIME` /
`HIVE_ACP_*`, which `mcp.nix` forwards onto its unit). On claude
nothing changes. On ACP, each run drives an `AcpRuntime` whose session
id is kept per name under the harness dir: `start` archives the old one,
`continue` loads it (and fails when none is recorded), `interrupt` sends
`session/cancel`, a role goes in front of the first prompt, and
permission requests get the answers a claude subagent's tool list
gives. The unit loads `backendEnvironmentFile` on ACP only, so the
agent can authenticate.

The end-of-turn handling moves out of the claude loop into `after_turn`
unchanged, so both loops share it.

Refs #4391

nix/module-eval/agent-runtime.nix

@@ -0,0 +1,73 @@
+# `checks.module-eval-agent-runtime` — see ./lib.nix for the shared
+# rationale (why this suite exists, naming convention, "evaluates
+# not executes").
+{
+  pkgs,
+  lib,
+  self,
+  nixosSystem,
+}:
+let
+  inherit
+    (import ./lib.nix {
+      inherit
+        pkgs
+        lib
+        self
+        nixosSystem
+        ;
+    })
+    agentWith
+    runGroup
+    ;
+
+  backendEnv = "/agents/a1/harness/backend.env";
+
+  # Both arms carry a backend file, so the claude arm's lack of one on the
+  # subagent unit is the gate and not a missing input.
+  agentOn =
+    runtime:
+    agentWith {
+      services.hyperhive.agent = {
+        inherit runtime;
+        backendEnvironmentFile = backendEnv;
+        acp.command = "/bin/agent";
+        acp.args = [ "acp" ];
+      };
+    };
+
+  claude = agentOn "claude";
+  acp = agentOn "acp";
+
+  subagent = machine: machine.systemd.services.hive-subagent-daemon;
+  harness = machine: machine.systemd.services.hive-agent;
+  runtimeVars = [
+    "HIVE_RUNTIME"
+    "HIVE_ACP_COMMAND"
+    "HIVE_ACP_ARGS"
+    "HIVE_ACP_ENV"
+  ];
+  cases = [
+    {
+      # The daemon reads these with `hive_runtime::RuntimeSpec`, the same
+      # parser as the harness, so equal values mean the same runtime.
+      name = "an ACP agent's subagent daemon gets the harness's runtime selection";
+      ok = lib.all (
+        var: (subagent acp).environment.${var} or null == (harness acp).environment.${var}
+      ) runtimeVars;
+    }
+    {
+      name = "an ACP agent's subagent daemon loads the backend credentials";
+      ok = (subagent acp).serviceConfig.EnvironmentFile or null == "-${backendEnv}";
+    }
+    {
+      # Unset is what `RuntimeSpec` reads as claude, and a claude subagent
+      # is not handed the backend file.
+      name = "a claude agent's subagent daemon has no runtime selection and no backend file";
+      ok =
+        lib.all (var: (subagent claude).environment.${var} or null == null) runtimeVars
+        && !((subagent claude).serviceConfig ? EnvironmentFile);
+    }
+  ];
+in
+runGroup "agent-runtime" cases