flake: expose agent-base + manager toplevels as packages, opt-in pre-build via hive-c0re module (closes #97)

nix/modules/hive-c0re.nix

@@ -2,6 +2,8 @@
   hyperhivePackage,
   hyperhiveFrontend,
   hyperhiveFlake,
+  agentBaseToplevel,
+  managerToplevel,
 }:
 {
   pkgs,
@@ -71,6 +73,32 @@ in
         approval needed.
       '';
     };
+    preBuildAgentTemplates = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = ''
+        Pre-fetch the per-container system closures (agent-base +
+        manager toplevels) into the host's /nix/store as part of this
+        host's NixOS build, instead of letting the first agent spawn
+        do all the work. Closes #97.
+
+        Enabling this adds roughly the full nixpkgs runtime closure +
+        claude-code + the harness binary to your system closure size
+        (low single-digit GB), but the first `nixos-container start`
+        for any agent then completes in seconds instead of minutes
+        because nothing's left to fetch.
+
+        Off by default because the toplevels are pinned to
+        `x86_64-linux` (nixos-containers run native arch). Enabling
+        on an aarch64 host would force nix to build the x86 closure
+        via cross or a remote builder, which is rarely what you want.
+        Flip to `true` on an x86_64 host when you care more about
+        first-spawn latency than host store size — or just
+        `nix build ${hyperhiveFlake}#agent-base-toplevel` once
+        manually to warm the store.
+      '';
+    };
     contextWindowTokens = lib.mkOption {
       type = lib.types.attrsOf lib.types.int;
       default = {
@@ -104,6 +132,17 @@ in
       pkgs.git
     ];
 
+    # Pull the per-container toplevels into the host system closure
+    # (#97). `system.extraDependencies` adds paths to the system build
+    # without referencing them at runtime — nixos-rebuild fetches /
+    # builds them, they end up in /nix/store, and the first
+    # nixos-container update + start for an agent has nothing left to
+    # do. Gated because the closure is sizeable and pinned to x86_64.
+    system.extraDependencies = lib.optionals cfg.preBuildAgentTemplates [
+      agentBaseToplevel
+      managerToplevel
+    ];
+
     # Dashboard + per-container web UIs share the host's network namespace and
     # need their ports reachable. Dashboard: `cfg.dashboardPort` (default 7000).
     # Manager: 8000. Sub-agents: 8100..8999 (deterministic hash; see