hand agents the dashboard port, pinned claude and otel labels at container start

The three values that differ per host (deploy.hive-controller.dashboardPort,
claudeCodePackage and otel.extraResourceAttributes) no longer go into the
meta flake. hive-priv writes them into the container's
/etc/hyperhive-hive-facts with the hive name and domain, and the agent
reads them at boot:

- HIVE_DASHBOARD_PORT reaches every unit through the hive-facts generator;
  the web UI still defaults to 7000 without it.
- `claude` on PATH is a wrapper that runs HYPERHIVE_CLAUDE_CODE_PATH's
  claude when it is there, and the container's own claude-code otherwise.
  The host's serve.json keeps gc-rooting the pinned build.
- OTEL_RESOURCE_ATTRIBUTES moves out of the units' Environment= into a
  boot-time generator, which appends HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES.

The agent options services.hyperhive.agent.claudeCodePath (now a removed
option) and otel.extraResourceAttributes go; only the meta render set them.
render_flake takes no HiveEnv any more, so the memory-cap render test and
render_hive_flake_at, which only existed to vary HiveEnv into the render,
go with it.

Refs #4857

hive-c0re/src/lifecycle/host_config.rs

@@ -25,7 +25,7 @@ use super::{
 pub async fn write_dropins(name: &str, hive: &HiveEnv, paths: &AgentPaths) -> Result<()> {
     validate(name)?;
     let container = container_name(name);
-    set_nspawn_flags(&container, &paths.agent, &paths.claude, &paths.notes).await?;
+    set_nspawn_flags(&container, hive, &paths.agent, &paths.claude, &paths.notes).await?;
     hand_permissions(name, &paths.agent);
     if let Some((cpu_quota, memory_max)) = stage_limits(
         name,
@@ -496,6 +496,7 @@ fn queue_agent_credentials(agent_name: &str, dir: Option<&Path>) -> Vec<Credenti
 )]
 async fn set_nspawn_flags(
     container: &str,
+    hive: &HiveEnv,
     runtime_dir: &Path,
     claude_dir: &Path,
     notes_dir: &Path,
@@ -669,7 +670,7 @@ async fn set_nspawn_flags(
         &binds,
         isolation,
         &load_creds,
-        super::hive_facts_from_env(),
+        super::hive_facts(hive),
     )
     .await
 }