feat(#1106): split bash mcp into hive-bash-daemon + hive-bash-mcp bridge

- new hive-bash-mcp crate: daemon (subprocess runner, wake signals) +
  stdio bridge (mcp tools). mirrors hive-matrix-mcp architecture
- hive-ag3nt: remove bash_runner.rs and bash_run/bash_status mcp tools;
  get_loose_ends uses hive_bash_mcp:🏃:active_tasks() via crate dep
- harness-base.nix: add hive-bash-daemon systemd service + auto-inject
  bash extraMcpServer into every agent (socket: /run/hive-bash/socket)

hive-bash-mcp/src/paths.rs

@@ -0,0 +1,67 @@
+//! Per-agent filesystem paths used by both `hive-bash-daemon` and the
+//! stdio MCP bridge.
+//!
+//! All paths are overridable via env vars so the operator can redirect
+//! them in agent.nix when needed.
+
+use std::path::PathBuf;
+
+/// Default unix socket path the daemon listens on inside the agent
+/// container. Lives under systemd's `RuntimeDirectory=hive-bash`
+/// (a tmpfs path that disappears on container restart — the daemon
+/// recreates the socket on its own boot) so the agent unix user can
+/// bind without root in `/run`.
+pub const DEFAULT_DAEMON_SOCKET: &str = "/run/hive-bash/socket";
+
+/// Resolve the daemon's unix socket path. Override via `HIVE_BASH_SOCKET`.
+#[must_use]
+pub fn daemon_socket() -> PathBuf {
+    std::env::var_os("HIVE_BASH_SOCKET")
+        .map_or_else(|| PathBuf::from(DEFAULT_DAEMON_SOCKET), PathBuf::from)
+}
+
+/// Base directory for task files. Uses `HYPERHIVE_HARNESS_DIR` if set
+/// (injected by hive-c0re meta flake after the harness/state split);
+/// falls back to a sibling of the state dir for pre-split deployments.
+#[must_use]
+pub fn tasks_dir() -> PathBuf {
+    let base = if let Some(p) = std::env::var_os("HYPERHIVE_HARNESS_DIR") {
+        PathBuf::from(p)
+    } else {
+        // Pre-split fallback: derive harness/ as a sibling of state/.
+        let state = std::env::var("HYPERHIVE_STATE_DIR").unwrap_or_default();
+        let state_path = PathBuf::from(&state);
+        state_path
+            .parent()
+            .map(|p| p.join("harness"))
+            .unwrap_or_else(|| PathBuf::from(state))
+    };
+    base.join("bash-tasks")
+}
+
+/// Hyperhive control socket — the daemon writes wake signals here so
+/// the harness drives a new claude turn on bash task completion.
+/// Mirrors the path used by `forge_notify` and `hive-matrix-mcp`.
+#[must_use]
+pub fn hyperhive_socket() -> PathBuf {
+    std::env::var_os("HIVE_CONTROL_SOCKET")
+        .map_or_else(|| PathBuf::from("/run/hive/mcp.sock"), PathBuf::from)
+}
+
+/// Full path for a task's JSON metadata file.
+#[must_use]
+pub fn task_json(id: &str) -> PathBuf {
+    tasks_dir().join(format!("{id}.json"))
+}
+
+/// Full path for a task's captured stdout.
+#[must_use]
+pub fn task_out(id: &str) -> PathBuf {
+    tasks_dir().join(format!("{id}.out"))
+}
+
+/// Full path for a task's captured stderr.
+#[must_use]
+pub fn task_err(id: &str) -> PathBuf {
+    tasks_dir().join(format!("{id}.err"))
+}