model persisted to /state; stop auto-allowing claude-code unfree

model persistence: /model <name> now writes to /state/hyperhive-model
(in-container), Bus::new reads it on init. operator override survives
harness restart and container rebuild; gone on --purge like every
other piece of agent state. path overridable via HYPERHIVE_MODEL_FILE
for tests. failure to persist is a warn, not fatal — runtime override
still applies, just won't survive a restart.

unfree opt-in: drop the auto-allowUnfreePredicate from
harness-base.nix and the claude-unstable overlay. operator now has to
set nixpkgs.config.allowUnfree (or a predicate listing claude-code)
in their own host config. silent unfree bypass was sketchy; this is
honest. readme + gotchas updated to spell out the snippet.

todo: drops model-persistence + container-crash + journald (all
shipped); adds per-agent send allow-list (constrain who an agent can
message).

nix/templates/harness-base.nix

@@ -7,7 +7,12 @@
 
   boot.isNspawnContainer = true;
 
-  nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (pkgs.lib.getName pkg) [ "claude-code" ];
+  # `claude-code` is unfree. hyperhive intentionally does NOT auto-allow
+  # it — the operator opts in by setting
+  # `nixpkgs.config.allowUnfreePredicate` (or `allowUnfree = true`) in
+  # their own host config / agent.nix. Without that, the per-agent
+  # build fails on this package and the operator sees an honest "this
+  # is unfree, are you sure?" error.
 
   environment.systemPackages = with pkgs; [
     hyperhive