send agent traffic through squid once its hive announces it

docs/process/conventions.md

@@ -43,10 +43,10 @@ agent's build, and neither do the hive's other per-host values: the dashboard
 port (`HIVE_DASHBOARD_PORT`), the pinned claude-code
 (`HYPERHIVE_CLAUDE_CODE_PATH`), extra OTEL labels
 (`HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES`) and the queue's address
-(`HIVE_AGENT_NATS_URL`, from `deploy.hive-controller.queue.agentNatsUrl`). `hive-priv` writes them to
+(`HIVE_AGENT_NATS_URL`, from `deploy.hive-controller.queue.agentNatsUrl`) and the egress proxy's address and direct hosts (`HIVE_SQUID_PROXY`, `HIVE_EGRESS_NO_PROXY`, see [the egress proxy](../networking/network.md#egress-proxy-squid)). `hive-priv` writes them to
 `/etc/hyperhive-hive-facts` before every container start, leaving out any the
 hive doesn't set; the agent then uses its own default. The agent's environment
-generator (`nix/agent-modules/hive-facts.nix`) passes them to every unit,
+generator (`nix/agent-modules/hive-facts.nix`) passes all but the two egress facts, which only the proxy fetch reads, to every unit,
 including `hivectl choom` sessions, and `/etc/set-environment` exports them in login
 shells that no unit starts (`nixos-container root-login`). None is part of
 an agent's closure, and an agent started on another hive reports that hive.
@@ -323,7 +323,7 @@ that value. Read it with
 `swarm_queue_client::agent_permissions::unrestricted`. The hive reads it for
 the agent's squid policy: [the egress proxy](../networking/network.md#egress-proxy-squid)
 lets an unrestricted agent's credential reach any destination, and holds the
-others to the allow-list. No agent sends a credential yet.
+others to the allow-list. An agent sends its credential once it has fetched it, from its next start.
 
 **How a change applies** —
 - The agent's harness reads its own key every 10 seconds and builds every