feat(stats): per-container cpu/mem load (#1424 p3)

C0NT41N3R L04D on the SYST3M tab + GET /api/container-resources.

Backend (hive-c0re/src/container_stats.rs): reads cgroup v2 cpu.stat +
memory.{current,peak,max} for each running agent machine
(machine-h\x2d<name>.scope under machine.slice), read-only/world-
readable so no hive-priv. CPU is a two-sample (~200ms) host-normalised
percentage; one shared sleep covers all agents. Skips agents whose
scope dir is absent (= not running). Network omitted: agents share the
host netns, no per-container counter.

Frontend: a polled C0NT41N3R L04D table on SYST3M (agent / cpu / mem /
peak / limit with meter bars), reusing the ST4TS table style. Polls
/api/container-resources every 5s only while the tab is active.

Backend reviewed-in-principle by damocles (path escaping + cpu delta
math); ping for the on-host sign-off.

frontend/packages/dashboard/src/index.html

@@ -191,6 +191,16 @@
         <p class="meta">loading…</p>
       </div>
 
+      <!-- C0NT41N3R L04D: live cpu + memory per agent container, read
+           from cgroup v2 on the host. Polled only while this tab is
+           active (cpu needs a short two-sample read each refresh). -->
+      <h2>◆ C0NT41N3R L04D ◆</h2>
+      <div class="divider">══════════════════════════════════════════════════════════════</div>
+      <p class="meta">live cpu + memory per agent container, from cgroup v2 on the host. cpu is % of total host capacity (all cores), sampled over ~200ms each refresh; polled every 5s while this tab is open. network is omitted on purpose — agents share the host netns, so there is no per-container counter (see <code>docs/network.md</code>).</p>
+      <div id="container-load-section">
+        <p class="meta">loading…</p>
+      </div>
+
     </section>
 
     <!-- P3RM1SS10NS: per-agent capability grants + tool-group