agents: login shells read the hive facts too; test the readers

Part of #5081. Follow-up to the review of #5131.

- Before this PR, claude read CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX
  from managed-settings.json in every context. The environment generator
  reaches every unit of the container's manager, including `machinectl
  shell` (hivectl choom): machined starts it as a transient
  container-shell@ unit (systemd 260.5 src/machine/machine.c:980-1004),
  and every unit's exec environment starts from the manager environment
  the generators fill (src/core/unit.c:5557, src/core/manager.c:3990-4001).
  Shells no unit starts do not get it: `nixos-container root-login` / `run`
  enter with nsenter + `su -l`, and getty logins go through login(1). So
  hive-facts.nix now also exports the generator's output from
  /etc/set-environment (environment.extraInit).
- The generator's read loop kept a last line only when it ended in a
  newline; it now keeps one without.
- checks.script-test-agent-hive-facts runs the rendered generator and the
  shell snippet (under dash and bash's sh) against sample files: both
  facts, a planted LD_PRELOAD/PATH line, a last line without a newline,
  an empty file and no file.
- identity.rs: hive_name()'s doc names the facts file as the source.

nix/script-tests/agent-hive-facts.nix

@@ -0,0 +1,41 @@
+# `checks.script-test-agent-hive-facts` — runs the two readers of
+# `/etc/hyperhive-hive-facts` in ../agent-modules/hive-facts.nix: the systemd
+# environment generator and the login-shell snippet `/etc/set-environment`
+# sources. The cases are in ./agent-hive-facts.sh.
+#
+# What runs is the rendered generator and snippet. The one edit is the facts
+# file's path, moved under the build directory, and the snippet's reference to
+# the generator, pointed at that edited copy.
+{
+  pkgs,
+  lib,
+  self,
+  nixosSystem,
+}:
+let
+  inherit
+    (import ../module-eval/lib.nix {
+      inherit
+        pkgs
+        lib
+        self
+        nixosSystem
+        ;
+    })
+    agentWith
+    ;
+
+  machine = agentWith { services.hyperhive.agent.user.name = "a1"; };
+in
+pkgs.runCommand "hyperhive-script-test-agent-hive-facts"
+  {
+    GENERATOR =
+      machine.environment.etc."systemd/system-environment-generators/50-hyperhive-hive-facts".source;
+    PROFILE = machine.environment.etc."hyperhive/hive-facts.sh".source;
+    EXTRA_INIT = machine.environment.extraInit;
+    SHELLS = "${pkgs.dash}/bin/dash ${pkgs.bash}/bin/sh";
+  }
+  ''
+    ${pkgs.bash}/bin/bash ${./agent-hive-facts.sh}
+    touch "$out"
+  ''

nix/script-tests/agent-hive-facts.sh

@@ -0,0 +1,71 @@
+# Cases for ./agent-hive-facts.nix. Each case writes a facts file (or none),
+# runs the generator with a clean environment, and compares its whole output;
+# then sources the login-shell snippet under each POSIX shell and compares what
+# a child process sees.
+set -uo pipefail
+
+failures=0
+count=0
+
+fail() {
+  echo "FAILED: $case: $*" >&2
+  failures=$((failures + 1))
+}
+
+dir=$(mktemp -d)
+facts=$dir/facts
+sed "s|/etc/hyperhive-hive-facts|$facts|g" "$GENERATOR" >"$dir/generator"
+chmod +x "$dir/generator"
+sed "s|$GENERATOR|$dir/generator|g" "$PROFILE" >"$dir/profile"
+envbin=$(command -v env)
+
+case="setup"
+if grep -q '/etc/hyperhive-hive-facts' "$dir/generator"; then fail "the generator still names /etc after the rewrite"; fi
+if ! grep -qF "$facts" "$dir/generator"; then fail "the rewrite did not reach the generator's read"; fi
+if ! grep -qF "$dir/generator" "$dir/profile"; then fail "the snippet does not call the rewritten generator"; fi
+if ! printf '%s\n' "$EXTRA_INIT" | grep -qxF '. /etc/hyperhive/hive-facts.sh'; then
+  fail "/etc/set-environment does not source the snippet"
+fi
+
+# check <description> <expected generator output>
+check() {
+  case=$1
+  count=$((count + 1))
+  local want=$2 got
+  got=$(env -i "$dir/generator")
+  if [ "$got" != "$want" ]; then
+    fail "generator printed:"$'\n'"$got"$'\n'"wanted:"$'\n'"$want"
+  fi
+  local sh
+  for sh in $SHELLS; do
+    # Only what the snippet exported reaches the child's environment. No PATH:
+    # the snippet must not need one.
+    got=$(env -i "$sh" -c ". '$dir/profile'; exec '$envbin'" | grep -E '^(HYPERHIVE_|CLAUDE_|LD_PRELOAD=|__hyperhive)' | sort)
+    if [ "$got" != "$(printf '%s\n' "$want" | sort)" ]; then
+      fail "$sh: a child of the sourcing shell saw:"$'\n'"$got"
+    fi
+  done
+}
+
+printf 'HYPERHIVE_HIVE_NAME=pr1ma\nHYPERHIVE_HIVE_DOMAIN=pr1ma.example.test\n' >"$facts"
+check "both facts" "HYPERHIVE_HIVE_NAME=pr1ma
+HYPERHIVE_HIVE_DOMAIN=pr1ma.example.test
+CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=pr1ma-a1"
+
+printf 'LD_PRELOAD=/x\nHYPERHIVE_HIVE_NAME=pr1ma\nPATH=/evil\n' >"$facts"
+check "a planted key is dropped" "HYPERHIVE_HIVE_NAME=pr1ma
+CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=pr1ma-a1"
+
+printf 'HYPERHIVE_HIVE_DOMAIN=pr1ma.example.test\nHYPERHIVE_HIVE_NAME=pr1ma' >"$facts"
+check "a last line without a newline is kept" "HYPERHIVE_HIVE_DOMAIN=pr1ma.example.test
+HYPERHIVE_HIVE_NAME=pr1ma
+CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=pr1ma-a1"
+
+: >"$facts"
+check "an empty file (no facts)" "CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=unknown-a1"
+
+rm -f "$facts"
+check "no file" "CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=unknown-a1"
+
+echo "$count cases, $failures failed"
+[ "$failures" -eq 0 ]