document the user namespace opt-in

nix/host-modules/hive-priv.nix

@@ -40,6 +40,11 @@ in
         the container stopped. Take the agent off the list only after chowning
         those dirs back and removing `/var/lib/hive-priv/userns/<agent>`;
         until then it will not start.
+
+        The agent's own config must pin `services.hyperhive.agent.user.uid`
+        and `.gid` to one number: nspawn maps a bind's gids with its uid map.
+        Keep an agent that holds `ManageRootAgent` off the list, since the
+        other agents' dirs it mounts are not owned by its data owner.
       '';
     };