docs: state the unlink mechanism precisely (write bit, not sticky bit)

Both the gateway doc and the tmpfiles comment said "a directory without
the sticky bit lets any user unlink files in it". True of the old 0777,
but it names the wrong lever: write permission on a directory is what
confers the right to unlink its entries, and the sticky bit is only a
restraint on that -- it was never set here, so it is not what 0751
changes. Dropping o=w removes the permission outright.

The fix is unchanged; this is so a future reader doesn't go looking for
a sticky bit that was never there. Caught in review by argus.

docs/gateway.md

@@ -107,9 +107,12 @@ now set unconditionally for every agent. The mechanism:
    Do **not** reintroduce a chown here: tmpfiles re-applies this entry
    on every boot *and* every agent spawn/destroy, so any ownership set
    afterwards is reverted the next time any agent changes. The mode is
-   also load-bearing — a directory without the sticky bit lets any user
-   unlink files in it, so a world-writable socket dir would let anything
-   that can reach the path replace an agent's socket with its own.
+   also load-bearing — write permission on a *directory* is what confers
+   the right to unlink its entries, whoever owns them, and the sticky bit
+   is the only thing that would restrain that (it is not set here). So a
+   world-writable socket dir would let anything able to reach the path
+   replace an agent's socket with its own; `o=--x` removes that
+   permission outright rather than qualifying it.
 3. **Marker gate**. After successful `bind_unix`, the harness drops
    `<dir>/hyperhive-socket-bound` next to the socket. c0re's
    `agent_sockets::write` filters its JSON map by marker presence —