docs(turn-loop): facts + structure pass

Frame the turn loop runtime-neutrally: every turn runs through
hive-runtime, on claude (default) or an ACP agent. The loop steps,
harness binary shape and hive-agent README now say so; claude-only
failure detection gets its own heading; claude-invocation.md opens with
its scope and links the ACP side to hive-runtime/README.md.

Fact fixes: on-boot file paths (/run/hive-config, not /run/hive),
hive-claude is a crates.io dependency with no README here, hive-agent
has no client.rs or forge_notify.rs, the claude launch-config layer is
hive-agent's mcp_config.rs, agent forge/matrix accounts are
swarm-controller's, hive-c0re's dashboard is dashboard/, and the
deprecated hyperhive.gui.enable / hyperhive.extraMcpServers spellings.

Refs #3902

CLAUDE.md

@@ -33,8 +33,9 @@ hand-maintained per-file tree drifts out of sync with the code.
   the separate `hivectl` crate, which talks to the daemon over the host
   admin socket. Owns the sqlite broker, approval + reminder +
   schedule queues, the meta flake, lifecycle (`nixos-container`
-  shellouts), gateway / forge / matrix provisioning, per-container stats,
-  and the axum operator dashboard (`dashboard.rs`). Largest crate.
+  shellouts), gateway / forge / matrix wiring (agent forge and matrix
+  accounts are `swarm-controller`'s), per-container stats, and the axum
+  operator dashboard (`dashboard/`). Largest crate.
 - **`hivectl/`** — standalone operator CLI (`hivectl` binary). Talks to
   the `hive-c0re` daemon over the host admin socket (`hive-host-sock`
   wire types) — does NOT link `hive-c0re`. Full, always-current verb
@@ -47,11 +48,10 @@ hand-maintained per-file tree drifts out of sync with the code.
 - **`hive-agent/`** — the serve-loop binary: turn-loop *policy* layer
   (`turn.rs`) over `hive-runtime`, per-agent web UI (`web_ui/`
   module dir), event + turn-stats sqlite sinks, login flow, system-prompt
-  renderer.
+  renderer, and the claude launch-config layer (`mcp_config.rs`:
+  tool-group/capability → `--allowedTools`, `--mcp-config` render).
 - **`hive-agent-mcp/`** — the embedded MCP server (long-lived
-  streamable-http listener, `hive-mcp-http` systemd unit) + its claude
-  launch-config layer (tool-group/capability → `--allowedTools`,
-  `--mcp-config` render).
+  streamable-http listener, `hive-mcp-http` systemd unit).
 - **`hive-runtime/`** — the runtime an agent's turns run on: one
   `Runtime` interface (`run`/`compact`/`archive`/`canceller`/`choices`) with a `claude` backend
   (a pass-through to `hive-claude`) and an `acp` backend (any Agent Client
@@ -89,7 +89,7 @@ hand-maintained per-file tree drifts out of sync with the code.
   journal, so both layers together store every record twice. Deliberately
   single-purpose — do not grow it into a utility crate.
 - **`hive-screen-mcp/`** — stdio MCP bridge for GUI agents
-  (`hyperhive.gui.enable`): `screenshot` via `grim`, `type_text` /
+  (`services.hyperhive.agent.gui.enable`): `screenshot` via `grim`, `type_text` /
   `key_press` via `wtype` (Wayland virtual-keyboard protocol), and
   `mouse_move` / `mouse_click` as RFB pointer events to the local neatvnc
   server. All userspace, no daemon of its own.
@@ -152,7 +152,7 @@ hand-maintained per-file tree drifts out of sync with the code.
   `hive-core-agent-sock` above: **this socket never leaves the container**
   and `hive-c0re` is not in the path at all — no broker round-trip, no
   long-poll, no marker files. Also carries `extra_mcp`: the
-  `hyperhive.extraMcpServers` spec + parsing, shared by `hive-agent` and
+  `services.hyperhive.agent.extraMcpServers` spec + parsing, shared by `hive-agent` and
   `hive-subagent-mcp` — not a socket protocol, just the natural home since
   both already depend on this crate.
 - **`hive-types/`** — zero-dependency (bar serde) leaf crate holding the