feat(#1930): forward otel headers credential into agent containers via nspawn --load-credential

nix/modules/hive-c0re.nix

@@ -236,11 +236,14 @@ in
       description = ''
         Absolute path to an operator-provided secret file whose contents
         become `OTEL_EXPORTER_OTLP_HEADERS` (e.g.
-        `Authorization=Bearer <token>`). Loaded via systemd
-        `LoadCredential` into each agent's unit-private credential store
-        at runtime, so the token is never copied into the nix store or
-        exposed in argv. Must be absolute. Leave null if the endpoint
-        needs no auth header.
+        `Authorization=Bearer <token>`). hive-c0re forwards this host
+        file into each agent container's credential store via
+        systemd-nspawn `--load-credential=otel-headers:<path>`; the inner
+        harness unit inherits it by name (`LoadCredential`), so the token
+        is never copied into the nix store, the generated config, a bind
+        mount, or argv. Must be absolute. Leave null if the endpoint
+        needs no auth header. A configured-but-missing file is skipped
+        with a log warning (OTEL still exports, without the auth header).
       '';
     };
 

nix/templates/harness-base.nix

@@ -1786,7 +1786,13 @@ in
           Group = userName;
         }
         // lib.optionalAttrs (otel.enable && otel.headersCredential != null) {
-          LoadCredential = [ "otel-headers:${otel.headersCredential}" ];
+          # Inherit form (no `:path`): hive-c0re forwards the host file at
+          # `headersCredential` into this container's credential store via
+          # nspawn `--load-credential=otel-headers:<host path>` (see
+          # lifecycle.rs::hive_load_credentials). The path isn't reachable
+          # from inside the container, so we inherit the already-loaded
+          # credential by name rather than re-reading the host path here.
+          LoadCredential = [ "otel-headers" ];
         };
       };