fix(#962): top_level_agents = parentless agents, not children of manager

Per mara's design: the role grants access to every agent with no parent
in the topology (parent=None), derived purely from structure. No agent
name is hardcoded. In normal operation this is just the manager; any
additional parentless agents the operator creates are also covered.

Update ROLE docstring, lifecycle.rs comment, and unit tests accordingly.
Add a multi-root test to document the behaviour with multiple parentless
agents.

hive-c0re/src/lifecycle.rs

@@ -1149,10 +1149,9 @@ fn set_nspawn_flags(
     }
 
     // `can_manage_top_level_agents` role: additionally mount every
-    // top-level agent (direct child of the manager) as a virtual child.
-    // Enables recovery — a role holder can update a top-level agent's
-    // config even when that agent is down. Also grants RO access to
-    // /applied and /meta.
+    // parentless agent in the topology as a virtual child. Enables
+    // recovery — a role holder can update those agents' configs even
+    // when they are down. Also grants RO access to /applied and /meta.
     if crate::topology::has_role(
         agent_name,
         crate::topology::ROLE_CAN_MANAGE_TOP_LEVEL_AGENTS,