feat(#1106): split bash mcp into hive-bash-daemon + hive-bash-mcp bridge

- new hive-bash-mcp crate: daemon (subprocess runner, wake signals) +
  stdio bridge (mcp tools). mirrors hive-matrix-mcp architecture
- hive-ag3nt: remove bash_runner.rs and bash_run/bash_status mcp tools;
  get_loose_ends uses hive_bash_mcp:🏃:active_tasks() via crate dep
- harness-base.nix: add hive-bash-daemon systemd service + auto-inject
  bash extraMcpServer into every agent (socket: /run/hive-bash/socket)

nix/templates/harness-base.nix

@@ -1118,6 +1118,40 @@ in
       };
     };
 
+    # Bash task runner daemon — long-running process that owns subprocess
+    # monitoring + completion wake signals. Always enabled (every agent
+    # needs bash tools). The stdio MCP bridge `hive-bash-mcp` connects
+    # to this daemon's socket per turn.
+    # Socket dir: /run/hive-bash/ — RuntimeDirectory keeps it on tmpfs.
+    systemd.services.hive-bash-daemon = {
+      description = "bash task runner daemon for hive-bash-mcp";
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        HIVE_BASH_SOCKET = "/run/hive-bash/socket";
+        HIVE_CONTROL_SOCKET = "/run/hive/mcp.sock";
+        RUST_LOG = "info";
+      };
+      serviceConfig = {
+        ExecStart = "${pkgs.hyperhive}/bin/hive-bash-daemon";
+        Restart = "on-failure";
+        RestartSec = 3;
+        User = userName;
+        Group = userName;
+        RuntimeDirectory = "hive-bash";
+      };
+    };
+
+    # Inject the bash MCP bridge into every agent's extraMcpServers.
+    # The bridge connects to hive-bash-daemon on the same socket.
+    hyperhive.extraMcpServers = {
+      bash = lib.mkDefault {
+        command = "${pkgs.hyperhive}/bin/hive-bash-mcp";
+        args = [ ];
+        env.HIVE_BASH_SOCKET = "/run/hive-bash/socket";
+        allowedTools = [ "*" ];
+      };
+    };
+
     # Re-fire the daemon when the matrix token appears (hive-c0re
     # provisions it after agent containers come up). Without this
     # the daemon would exit 0 silently on first boot and the MCP