hive-priv: lock personality, deny realtime, kernel logs and module loading

Adds LockPersonality, RestrictRealtime, ProtectKernelLogs and
ProtectKernelModules to the hive-priv unit. Nothing in hive-priv's
sources or its children uses personality(2), real-time scheduling,
/dev/kmsg, /proc/kmsg or explicit module loading.

A module-eval case pins the four directives on the rendered unit.

nix/host-modules/hive-priv.nix

@@ -148,6 +148,15 @@ in
         # meta/applied repos; libgit2 refuses them without safe.directory.
         # See safeDirGitconfig above.
         ExecStartPre = "+-${pkgs.coreutils}/bin/cp ${safeDirGitconfig} /var/lib/hive-priv/.gitconfig";
+        # Kernel surfaces neither hive-priv nor its children use: no
+        # personality(2), no real-time scheduling, no /dev/kmsg or
+        # /proc/kmsg, no explicit module loading (kernel-initiated autoload
+        # still works). Container start/stop run in `container@.service`,
+        # not under this unit.
+        LockPersonality = true;
+        RestrictRealtime = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
       };
     };
   };