docs: drop harness systemd settings; swarm-nats-auth: refuse the hive's shared agent client

Docs (review on #4948): the harness's restart settings are not useful to
a reader, so the `Restart`/`RestartSec` bullet in docs/turn-loop and the
"30 seconds later, no start limit" wording in docs/swarm are removed.
What stays is the behaviour: the harness exits and comes back until the
queue accepts it.

Grant: with the harness's shared-client fallback gone, nothing presents
the hive's shared agent client (`hive-<hive>-agent`) to the queue;
swarm-logs uses that OIDC client over HTTP only. swarm-nats-auth now
refuses it outright instead of granting the configured
`$SWARM.term.{hive}.>` / `$SWARM.agent-state.{hive}.>` publish and its
`_INBOX.client.<id>.>` subscribe, so an agent holding it can no longer
publish as a sibling. The agent arm still runs before the hive arm, so
that id never falls through to its hive's grant.

Removed with it: the `--agent-publish-subject` flag and its two uses in
swarm-nats.nix, `Policy`'s agent subject list, and
swarm-queue-client's `client_inbox_prefix`. The module-eval now asserts
the flag is absent; the policy tests assert the refusal and that the
hive itself is still admitted.

docs/swarm/README.md

@@ -158,10 +158,9 @@ show the agent nor send it anything, so a harness without one stops:
   wait each time, and logs a warning for each attempt that fails. After the
   seventh, about five minutes in, it logs an error and exits.
 
-Either way the `hive-agent` unit fails, and systemd starts it again 30 seconds
-later, with no start limit, until the queue accepts it. Once connected, the
-client reconnects by itself after a dropped connection, reading the credential
-from the store again for each attempt.
+Either way the harness exits and comes back until the queue accepts it. Once
+connected, the client reconnects by itself after a dropped connection, reading
+the credential from the store again for each attempt.
 
 The hive's shared queue client is still delivered into the harness unit's
 credentials directory, and `swarm.statusPublish.tokenEndpoint` still reaches
@@ -244,12 +243,12 @@ The queue also limits what an agent may **subscribe** to, because agents are the
 least trusted clients on the queue. An agent's own queue credential, which its
 subagent daemon also presents, may subscribe to its reply inbox
 `_INBOX.agent.<agent>.>` and its operator-input subject `$SWARM.input.<agent>`,
-and nothing else. The hive's shared agent client may subscribe to its reply
-inbox `_INBOX.client.<client-id>.>` only. The harness and the subagent daemon
-connect with `_INBOX.agent.<agent>` as their inbox prefix, so the replies to
-the icon write and the schedule read arrive. Neither credential can read
-another agent's terminal, state, input or replies. Hives and the swarm
-controller may still subscribe to any subject in the account.
+and nothing else. The harness and the subagent daemon connect with
+`_INBOX.agent.<agent>` as their inbox prefix, so the replies to the icon write
+and the schedule read arrive. An agent can't read another agent's terminal,
+state, input or replies. The queue refuses the hive's shared agent client
+outright. Hives and the swarm controller may still subscribe to any subject in
+the account.
 
 </details>
 

docs/swarm/schedules.md

@@ -78,8 +78,8 @@ or within a minute if the controller's first attempt to pass it on failed.
 
 - **The agent isn't connected to the swarm queue.** It reads its prompts with
   its own swarm-queue credential. A harness that can't connect retries for
-  about five minutes, then exits and restarts 30 seconds later; it reads no
-  prompts until a connect succeeds. See
+  about five minutes, then exits and comes back; it reads no prompts until a
+  connect succeeds. See
   [Giving the agents the queue too](README.md#giving-the-agents-the-queue-too).
 - **The agent hasn't read its prompts since it started.** It fires from the
   last list it read; until the first read succeeds it fires nothing. A read

docs/turn-loop/README.md

@@ -226,8 +226,6 @@ uid 0 and have the setuid bit set."
   (`nix/agent-modules/agent-service.nix:535`); `packages.hive-agent` is
   wired to the flake's `hyperhive.packages.<system>.hive-agent` output
   (`nix/agent-modules/packages.nix:8-22`) — same binary for every agent.
-- `Restart = on-failure`, `RestartSec = 2` — keeps the harness
-  resilient across transient crashes without thundering retries.
 - `RuntimeDirectory = "hive-config"` → `/run/hive-config/` owned by
   `User=`, autocleared on stop. The harness writes regenerated
   `claude-{mcp-config,settings,system-prompt}` files there