fix(systemd): set explicit SyslogIdentifier on hyperhive-declared units

Follow-up to the harness fix: any unit whose ExecStart is a generated
wrapper (a NixOS `script =` block or a writeShellScript) gets its journal
SyslogIdentifier derived from the wrapper's store-path basename — an
opaque, unstable name. Pin an explicit stable identifier on every unit
hyperhive declares.

script/wrapper units (leaked store paths): forgejo-gpg-init,
hive-gateway-self-signed-cert, hive-tls-ca, hive-ci-prefetch,
hyperhive-isolated-dns, tea-login, forge-avatar-sync,
matrix-avatar-sync, hive-dashboard-links.

direct-binary units (basename already sane; explicit for tidiness +
future-proofing): hive-c0re, hive-priv, hive-matrix-daemon,
hive-bash-daemon, weston.

Only changes the displayed line identifier; journalctl -u <unit>
filtering (keys on _SYSTEMD_UNIT) is unaffected.

nix/templates/weston-vnc.nix

@@ -136,6 +136,10 @@ in
             --socket=wayland-0 \
             --disable-transport-layer-security
         '';
+        # ExecStart is already a direct `weston` exec (basename is clean), but
+        # pin the identity explicitly so it can't drift if a wrapper is ever
+        # introduced (sweep per the systemd SyslogIdentifier convention).
+        SyslogIdentifier = "weston";
         Restart = "on-failure";
         RestartSec = "5s";
       };