agents: login shells read the hive facts too; test the readers

Part of #5081. Follow-up to the review of #5131.

- Before this PR, claude read CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX
  from managed-settings.json in every context. The environment generator
  reaches every unit of the container's manager, including `machinectl
  shell` (hivectl choom): machined starts it as a transient
  container-shell@ unit (systemd 260.5 src/machine/machine.c:980-1004),
  and every unit's exec environment starts from the manager environment
  the generators fill (src/core/unit.c:5557, src/core/manager.c:3990-4001).
  Shells no unit starts do not get it: `nixos-container root-login` / `run`
  enter with nsenter + `su -l`, and getty logins go through login(1). So
  hive-facts.nix now also exports the generator's output from
  /etc/set-environment (environment.extraInit).
- The generator's read loop kept a last line only when it ended in a
  newline; it now keeps one without.
- checks.script-test-agent-hive-facts runs the rendered generator and the
  shell snippet (under dash and bash's sh) against sample files: both
  facts, a planted LD_PRELOAD/PATH line, a last line without a newline,
  an empty file and no file.
- identity.rs: hive_name()'s doc names the facts file as the source.

nix/agent-modules/hive-facts.nix

@@ -3,9 +3,17 @@
 #
 # hive-priv writes `/etc/hyperhive-hive-facts` into the container before every
 # start (`HYPERHIVE_HIVE_NAME`, `HYPERHIVE_HIVE_DOMAIN`, one `KEY=value` line
-# each). This environment generator hands those lines to the container's
-# systemd, which passes them to every unit it starts and to `machinectl shell`
-# sessions; a unit's own `Environment=` still overrides them.
+# each). Two readers hand those lines on:
+#
+# - an environment generator, for the container's systemd: it passes them to
+#   every unit it starts, `machinectl shell` sessions (`hivectl choom`)
+#   included, since those are transient units of the same manager. A unit's
+#   own `Environment=` still overrides them.
+# - `/etc/set-environment`, for login shells that no unit starts:
+#   `nixos-container root-login` / `run` (nsenter + `su -l`, which resets the
+#   environment) and getty logins.
+#
+# Tested by `checks.script-test-agent-hive-facts`.
 {
   config,
   lib,
@@ -14,24 +22,41 @@
 }:
 let
   userName = config.services.hyperhive.agent.user.name;
+
+  # Shell builtins only: nothing is assumed on PATH this early. Only the two
+  # known keys are passed on. `|| [ -n "$key" ]` keeps a last line that has
+  # no trailing newline.
+  generator = pkgs.writeShellScript "hyperhive-hive-facts" ''
+    hive=unknown
+    if [ -r /etc/hyperhive-hive-facts ]; then
+      while IFS='=' read -r key value || [ -n "$key" ]; do
+        case "$key" in
+          HYPERHIVE_HIVE_NAME) hive=$value ;;
+          HYPERHIVE_HIVE_DOMAIN) ;;
+          *) continue ;;
+        esac
+        printf '%s=%s\n' "$key" "$value"
+      done < /etc/hyperhive-hive-facts
+    fi
+    # Names claude's remote-control sessions `<hive>-<agent>`.
+    printf 'CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=%s-%s\n' "$hive" ${lib.escapeShellArg userName}
+  '';
+
+  # Sourced by every shell's `/etc/set-environment`, so POSIX sh only. Each
+  # line is exported as one word and never evaluated.
+  profile = pkgs.writeText "hyperhive-hive-facts.sh" ''
+    while IFS= read -r __hyperhive_fact; do
+      case "$__hyperhive_fact" in
+        ?*=*) export "$__hyperhive_fact" ;;
+      esac
+    done <<__HYPERHIVE_FACTS__
+    $(${generator})
+    __HYPERHIVE_FACTS__
+    unset __hyperhive_fact
+  '';
 in
 {
-  # Shell builtins only: nothing is assumed on PATH this early. Only the two
-  # known keys are passed on.
-  environment.etc."systemd/system-environment-generators/50-hyperhive-hive-facts".source =
-    pkgs.writeShellScript "hyperhive-hive-facts" ''
-      hive=unknown
-      if [ -r /etc/hyperhive-hive-facts ]; then
-        while IFS='=' read -r key value; do
-          case "$key" in
-            HYPERHIVE_HIVE_NAME) hive=$value ;;
-            HYPERHIVE_HIVE_DOMAIN) ;;
-            *) continue ;;
-          esac
-          printf '%s=%s\n' "$key" "$value"
-        done < /etc/hyperhive-hive-facts
-      fi
-      # Names claude's remote-control sessions `<hive>-<agent>`.
-      printf 'CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=%s-%s\n' "$hive" ${lib.escapeShellArg userName}
-    '';
+  environment.etc."systemd/system-environment-generators/50-hyperhive-hive-facts".source = generator;
+  environment.etc."hyperhive/hive-facts.sh".source = profile;
+  environment.extraInit = ". /etc/hyperhive/hive-facts.sh";
 }