fix(#2860): make hyperhive.forge.url nullable instead of guessing a URL

The option had a `http://localhost:3000` default, which is only ever
correct when the forge shares the caller's network namespace — inside an
agent's netns `localhost` is the agent, and the forge may well be on
another host. Making it *required* instead was worse: the flake's own
container configs are what hive-c0re extends per agent, so the value
they needed in order to evaluate became a second definition on every
agent and collided with the real one.

`null` resolves both. It is not a URL, so nothing can quietly talk to
the wrong machine, and it needs no placeholder anywhere: the bases
evaluate as they are, so nothing deployment-shaped sits on the config
agents inherit from. The units that would consume the URL — tea-login
and forge-avatar-sync — are simply not generated without one, making an
absent forge an absent integration rather than a misdirected one.

hive-forge-notify is unaffected: it reads HIVE_FORGE_URL from the
forwarded global environment, not from this option.

Verified:
  agent-base/ruth evaluate with forge.url = null, zero failing assertions
  bare base:      tea_login_present = false, avatar_present = false,
                  notify_present = true
  extended with a rendered URL: FORGE_URL=http://forge.real.test

Refs #2860

flake.nix

@@ -149,34 +149,20 @@
 
       nixosConfigurations =
         let
-          # Values the agent modules require but that only a real
-          # deployment can know. Real containers are built from the
-          # generated meta flake, where hive-c0re renders these per
-          # agent from the host's `HIVE_FORGE_URL` (see meta.rs's
-          # `SERVICE_URL_OPTIONS`) — they never evaluate through
-          # `self.nixosConfigurations`, so nothing here can reach a
-          # running agent. These two configs exist only to typecheck
-          # the modules and to pre-build the container closure
-          # (`system.extraDependencies`, see hive-c0re/default.nix).
-          #
-          # Deliberately a `.invalid` host (RFC 2606: guaranteed not to
-          # resolve) rather than something plausible like a loopback
-          # port. If this value ever *did* escape into a runtime path,
-          # it must fail loudly at DNS instead of quietly connecting to
-          # whatever happens to be listening — which is the entire
-          # point of removing the `http://localhost:3000` default this
-          # replaces.
-          evalOnlyPlaceholders = {
-            hyperhive.forge.url = "http://forge.invalid";
-          };
+          # These two configs are what hive-c0re extends per agent
+          # (meta.rs's `mkAgent` does `<base>.extendModules { … }`, so
+          # the built base and every container stay on one version).
+          # Nothing deployment-specific may be set here: it would be
+          # inherited by every container on the hive and collide with
+          # the per-agent values hive-c0re renders. The agent modules
+          # are written so a bare evaluation needs no such values —
+          # service URLs default to `null`, meaning "not configured",
+          # and the units that would use them simply aren't generated.
           mkContainer =
             module:
             nixpkgs.lib.nixosSystem {
               system = "x86_64-linux";
-              modules = [
-                module
-                evalOnlyPlaceholders
-              ];
+              modules = [ module ];
             };
         in
         {