otel: build the hive tier's collector from contrib

The hive tier has to *present* a credential to the swarm tier, and the
upstream collector build ships no auth extensions at all — `oauth2client`
exists only in contrib. So this is what makes authenticated egress
expressible, not a preference between two equivalent packages.

It also matches the swarm tier, which has been on contrib since it was
written. Two tiers of the same pipeline built from different component
sets is a difference nobody would predict from reading either module.

Not a build-farm cost: contrib is fetched, not compiled.

No behaviour change on its own — nothing names an extension yet. The
config that does lands separately, because that is the commit whose
failure mode needs a running collector to detect: `otelcol validate`
accepts a receiver naming an absent extension and the process then dies
at startup, so a green build proves nothing about it.

nix/host-modules/otel.nix

@@ -224,6 +224,22 @@ in
 
       services.opentelemetry-collector = {
         enable = true;
+        # Contrib, matching the swarm tier (./swarm-otel.nix). The upstream
+        # default build has no auth extensions at all, and this tier has to
+        # *present* a credential to the swarm tier — `oauth2client` lives
+        # only in contrib, so the package choice is what makes authenticated
+        # egress expressible rather than a preference.
+        #
+        # Not a build-farm cost: contrib is fetched, not compiled.
+        #
+        # ⚠️ Read the note directly below before adding any extension here.
+        # It describes precisely the trap this package unlocks: naming an
+        # extension the build lacks passes `validate` and then kills the
+        # collector at startup. With contrib the extensions exist — but the
+        # gap it warns about (a green build proving nothing about whether
+        # the process starts) is exactly why this module's auth wiring is
+        # gated by a probe that runs both collectors, not by eval.
+        package = pkgs.opentelemetry-collector-contrib;
         # `validateConfigFile` defaults to `isStorePath configFile`,
         # and `configFile` is null on the `settings` path — so the
         # upstream default is OFF for exactly the way this module