hand agents the queue address at container start

HIVE_AGENT_NATS_URL now reaches each container in its hive facts, from
the host's deploy.hive-controller.queue.agentNatsUrl, instead of being
rendered into the meta flake. The agent option
services.hyperhive.agent.queue.natsUrl is removed; the harness unit
imports the queue credential whenever the token endpoint is set.

On deploy every agent rebuilds once (the rendered flake loses the
address), and the harness reads the address from the facts file
hive-priv writes before each start.

Refs #4857

hive-c0re/src/lifecycle/mod.rs

@@ -170,8 +170,8 @@ pub fn network_isolation_from_env() -> Result<hive_priv_sock::NetworkIsolation>
 }
 
 /// The hive's facts every container is handed at runtime, so that no agent
-/// build carries a value that differs between hosts. The name, domain and
-/// OTEL resource labels come from hive-c0re's own unit environment
+/// build carries a value that differs between hosts. The name, domain, OTEL
+/// resource labels and queue address come from hive-c0re's own unit environment
 /// (`nix/host-modules/hive-c0re/environment.nix`), where an unset or empty
 /// variable is `None`; the dashboard port and pinned claude from `hive`.
 fn hive_facts(hive: &HiveEnv) -> hive_priv_sock::HiveFacts {
@@ -190,6 +190,7 @@ fn hive_facts_from(
         dashboard_port: Some(hive.dashboard_port),
         claude_code_path: hive.claude_code_path.clone(),
         otel_extra_resource_attributes: read("HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES"),
+        agent_nats_url: read("HIVE_AGENT_NATS_URL"),
     }
 }
 

hive-c0re/src/lifecycle/tests.rs

@@ -528,9 +528,9 @@ async fn run_with_deadline_returns_output_of_a_fast_child() {
     assert_eq!(String::from_utf8_lossy(&out.stdout).trim(), "hi");
 }
 
-/// The three per-host values reach the container as facts: the dashboard
-/// port and pinned claude from the hive's config, the OTEL labels from the
-/// daemon's environment.
+/// The per-host values reach the container as facts: the dashboard port and
+/// pinned claude from the hive's config, the OTEL labels and the queue
+/// address from the daemon's environment.
 #[test]
 fn hive_facts_carry_the_per_host_values() {
     let hive = HiveEnv {
@@ -538,8 +538,10 @@ fn hive_facts_carry_the_per_host_values() {
         claude_code_path: Some("/nix/store/0abc-claude-code".to_owned()),
         ..HiveEnv::default()
     };
-    let facts = hive_facts_from(&hive, |name| {
-        (name == "HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES").then(|| "team=a".to_owned())
+    let facts = hive_facts_from(&hive, |name| match name {
+        "HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES" => Some("team=a".to_owned()),
+        "HIVE_AGENT_NATS_URL" => Some("tls://nats.t.local:4222".to_owned()),
+        _ => None,
     });
     assert_eq!(facts.dashboard_port, Some(7123));
     assert_eq!(
@@ -550,6 +552,10 @@ fn hive_facts_carry_the_per_host_values() {
         facts.otel_extra_resource_attributes.as_deref(),
         Some("team=a")
     );
+    assert_eq!(
+        facts.agent_nats_url.as_deref(),
+        Some("tls://nats.t.local:4222")
+    );
 }
 
 /// Unset and empty both leave a fact out, so the agent falls back to its
@@ -561,5 +567,6 @@ fn hive_facts_leave_unset_values_out() {
     });
     assert_eq!(facts.claude_code_path, None);
     assert_eq!(facts.otel_extra_resource_attributes, None);
+    assert_eq!(facts.agent_nats_url, None);
     assert_eq!(facts.name, None);
 }

hive-c0re/src/meta.rs

@@ -1175,12 +1175,12 @@ mod tests {
         );
     }
 
-    /// The queue address reaches the harness as env only. The agent module
-    /// declares no `services.hyperhive.agent.queue.*` option, so rendering one
-    /// into the meta flake fails every agent's evaluation.
+    /// The queue address reaches the container in its hive facts, so the render
+    /// carries neither it nor any `services.hyperhive.agent.queue.*` option,
+    /// which no agent module declares.
     #[test]
-    fn queue_address_is_forwarded_as_env_and_no_option() {
-        assert!(FORWARDED_VARS.contains(&"HIVE_AGENT_NATS_URL"));
+    fn queue_address_is_not_rendered_into_the_flake() {
+        assert!(!FORWARDED_VARS.contains(&"HIVE_AGENT_NATS_URL"));
         assert!(
             !FORWARDED_VARS.contains(&"HIVE_AGENT_OIDC_TOKEN_ENDPOINT"),
             "no agent reads a token endpoint"