feat(#1114): filter hyperhive flake source via named hyperhiveFlakeSource

Replace the unfiltered hyperhiveFlake = "${self}" (handed to hive-c0re
as the flake path it builds agent containers from) with a named,
explicitly-filtered source derivation that drops files no nix or cargo
derivation reads: docs/, scripts/, and root-level *.md. Editing those no
longer changes the hyperhiveFlake store path, so it no longer forces a
rebuild of every agent container.

This is the per-package source-filter pattern (operator request on
#1114): each real source is a named filtered derivation used as src,
not an inline filter at the use site. Companion to the existing rust
cleanSrc (crane cargo-source filter); supersedes the inline nixSrc
approach in the older #1114 branch.

Safe: hive-c0re consumes hyperhiveFlake as a runtime path string and
builds packages/nixosConfigurations from it (nix build <path>#…), which
never forces the checks that reference ./docs — and no package, module,
or container config reads docs/scripts/root-md.

flake.nix

@@ -28,6 +28,33 @@
         "aarch64-linux"
         "x86_64-linux"
       ];
+      # Explicit per-consumer source filter for the hyperhive flake path
+      # handed to hive-c0re (`hyperhiveFlake`, below). A filtered view of
+      # this repo that drops files no nix or cargo derivation reads —
+      # documentation, shell helper scripts, and root-level markdown — so
+      # editing them does NOT change the store path and therefore does NOT
+      # force a rebuild of every agent container.
+      #
+      # Companion to the rust `cleanSrc` (crane's cargo-source filter):
+      # each real source is a named, explicitly-filtered derivation used
+      # as `src`, rather than an inline filter at the use site.
+      #
+      # Dropped: docs/, scripts/, root-level *.md (README/CLAUDE/TODO/…).
+      # Kept (build needs them): .nix, .rs, Cargo.*, branding/, frontend/,
+      # prompts/, flake.lock.
+      hyperhiveFlakeSource = lib.cleanSourceWith {
+        name = "hyperhive-flake-source";
+        src = ./.;
+        filter =
+          path: type:
+          let
+            # Repo-relative path (strip the absolute source-dir prefix).
+            rel = lib.removePrefix (toString ./. + "/") (toString path);
+          in
+          !(lib.hasPrefix "docs/" rel || rel == "docs")
+          && !(lib.hasPrefix "scripts/" rel || rel == "scripts")
+          && !(type == "regular" && !lib.hasInfix "/" rel && lib.hasSuffix ".md" rel);
+      };
       treefmt-config = {
         projectRootFile = "flake.nix";
         programs = {
@@ -234,7 +261,7 @@
           hyperhivePackage = system: self.packages.${system}.default;
           hyperhiveFrontend = system: self.packages.${system}.frontend;
           hyperhiveAssets = system: self.packages.${system}.assets;
-          hyperhiveFlake = "${self}";
+          hyperhiveFlake = "${hyperhiveFlakeSource}";
           # Store path of the nixpkgs-unstable input this flake was evaluated
           # with — the channel that carries claude-code. Passed as the default
           # for `services.hyperhive.c0re.nixpkgsUnstableFlake` so operators can