nix/harness-base: prepend /run/wrappers/bin to PATH (argus #676 / #672 fixup)

argus on #676 🔴: this PR deletes agent-base.nix + manager.nix and
moves the harness service to harness-base.nix without carrying
forward damocles's #672 fix (which adds `/run/wrappers/bin` to the
service PATH so the setuid sudo wrapper resolves before the bare
nix-store binary).

Pull the #672 fix forward: prepend `/run/wrappers/bin` to the unified
harness service's path list. Same shape as damocles's diff on
agent-base + manager, but applied once in harness-base.nix.

Without this, post-#658 `sudo` inside the container resolves to the
un-setuid nix-store binary and refuses with "must be owned by uid 0
and have the setuid bit set" even when
`hyperhive.user.passwordlessSudo = true` is configured.

Verified via `nix eval`:
- agent-base.systemd.services.hive-ag3nt.path[0] = "/run/wrappers/bin" ✓
- manager.systemd.services.hive-m1nd.path[0]    = "/run/wrappers/bin" ✓

#672 (damocles) supersedes when this lands — the two changes are
equivalent and the consolidated harness-base.nix is now the canonical
home for the fix.

nix/templates/harness-base.nix

@@ -75,6 +75,31 @@ in
     '';
   };
 
+  options.hyperhive.role = lib.mkOption {
+    type = lib.types.enum [
+      "agent"
+      "manager"
+    ];
+    default = "agent";
+    example = "manager";
+    description = ''
+      Whether this container runs as a sub-agent (`"agent"`, the
+      default — invokes `hive-ag3nt serve`) or as the swarm's
+      manager (`"manager"` — invokes `hive-m1nd serve` and
+      defaults the forge notification surface to mentions-only).
+
+      meta.rs flips this to `"manager"` for the manager container
+      and leaves it at the default for every sub-agent. Agents
+      and `agent.nix` files don't normally touch this option;
+      it's exposed so a standalone `nixos-rebuild` against
+      `nixosConfigurations.manager` keeps working without the
+      meta-flake wrapper around it.
+
+      Closes #671: harness + manager templates merged into a
+      single `harness-base.nix` driven by this option.
+    '';
+  };
+
   options.hyperhive.model = lib.mkOption {
     type = lib.types.str;
     default = "haiku";
@@ -1191,6 +1216,106 @@ in
       };
     };
 
+    # Manager-only forge defaults (#671): skip the
+    # subscription/participation firehose so the manager's inbox
+    # only carries direct mentions, reviews, and assignments. Sub-
+    # agents keep the noisier defaults (`keepSubscriptions = true`,
+    # `skipNotifyReasons = [ ]`). `mkDefault` so any agent that
+    # wants to invert it can.
+    hyperhive.forge = lib.mkIf (config.hyperhive.role == "manager") {
+      keepSubscriptions = lib.mkDefault false;
+      skipNotifyReasons = lib.mkDefault [
+        "subscribed"
+        "participating"
+      ];
+    };
+
+    # Harness systemd unit. Role-driven so the same `harness-base.nix`
+    # covers both `nixosConfigurations.agent-base` (`hive-ag3nt serve`)
+    # and `nixosConfigurations.manager` (`hive-m1nd serve`) without a
+    # second template file (#671). Per-agent HIVE_PORT / HIVE_LABEL
+    # come from the meta-flake's generated `applied/<name>/flake.nix`;
+    # the manager has hardcoded fallbacks here so `nixosConfigurations.manager`
+    # still builds standalone.
+    systemd.services.${if config.hyperhive.role == "manager" then "hive-m1nd" else "hive-ag3nt"} =
+      let
+        isManager = config.hyperhive.role == "manager";
+        binary = if isManager then "hive-m1nd" else "hive-ag3nt";
+      in
+      {
+        description = "${binary}${lib.optionalString isManager " manager"} harness";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        # systemd units get a minimal PATH by default and don't inherit
+        # `environment.systemPackages`. Pointing at `/run/current-system/sw`
+        # gives the harness (and any tools claude shells out to via Bash)
+        # access to everything declared in `systemPackages` — including
+        # anything an agent adds to its own `agent.nix` — without having
+        # to touch the service definition.
+        #
+        # `/run/wrappers/bin` prepended so the `security.wrappers`
+        # setuid shims (notably `sudo`) resolve before the bare
+        # nix-store binaries in `/run/current-system/sw/bin`.
+        # Post-#658 the harness runs as the per-agent user — without
+        # the wrapper dir on PATH, `sudo` resolves to the un-setuid
+        # nix-store binary and refuses with "must be owned by uid 0
+        # and have the setuid bit set" even when
+        # `hyperhive.user.passwordlessSudo = true` is configured
+        # (#672 fixup pulled forward into this PR to avoid the
+        # regression argus flagged on #676).
+        path = [
+          "/run/wrappers/bin"
+          "/run/current-system/sw"
+        ];
+        environment = {
+          SHELL = "${pkgs.bashInteractive}/bin/bash";
+          # `HOME` defaults to `/` for systemd services without a User=
+          # set. With #658 the harness runs as the agent user — set HOME
+          # explicitly so claude (which the harness spawns) finds its
+          # `~/.claude/` session dir at the bind-mounted location.
+          HOME = homeDir;
+          # Path to the merged agent static dist. The harness serves this
+          # via `tower_http::ServeDir` for any request it doesn't route to
+          # an API endpoint. `mergedDist` is the agent-default dist with
+          # `hyperhive.frontend.extraFiles` layered on top.
+          HIVE_STATIC_DIR = "${config.hyperhive.frontend.mergedDist}";
+          # Static runtime assets (branding + claude prompts). Set on the
+          # unit directly — `environment.variables` only populates
+          # /etc/profile, which systemd services don't inherit.
+          HIVE_ASSETS_DIR = "${pkgs.hyperhive-assets}/share/hyperhive";
+        }
+        // lib.optionalAttrs isManager {
+          # Standalone-eval fallbacks for `nixosConfigurations.manager`.
+          # meta.rs overrides both via the per-agent generated
+          # `applied/hm1nd/flake.nix` (see `lifecycle::setup_applied`);
+          # the values here keep the container sensible if anyone
+          # evaluates the standalone config.
+          HIVE_PORT = "8000";
+          HIVE_LABEL = "hm1nd";
+        };
+        serviceConfig = {
+          ExecStart = "${pkgs.hyperhive}/bin/${binary} serve";
+          Restart = "on-failure";
+          RestartSec = 2;
+          # `/run/hive-config/` is a per-service runtime dir owned by
+          # the agent user (`User=` below), auto-cleared by systemd on
+          # stop. The harness writes its regenerated
+          # claude-{mcp-config,settings,system-prompt} files there
+          # (see `paths::config_dir`). Kept separate from `/run/hive`
+          # — that bind comes in root-owned from the host and holds
+          # hive-c0re's `mcp.sock` we only connect to (#658 fixup).
+          RuntimeDirectory = "hive-config";
+          # Run the harness as the per-agent user (#658). claude itself
+          # spawned by the harness then runs as that user too — drops
+          # root inside the container while sudo (`NOPASSWD: ALL` by
+          # default, see `hyperhive.user.passwordlessSudo`) keeps the
+          # previous root-by-default surface available explicitly for
+          # tools that need it.
+          User = userName;
+          Group = userName;
+        };
+      };
+
     system.stateVersion = "25.11";
   };
 }