fix(#3125): the swarm collector writes its own resolver, like its siblings

All four sibling swarm containers import swarm-container-resolver.nix;
this one did not. It matters more here than most: otel.endpoint is an
operator-configured external hostname, and reaching it is the entire
reason this container holds a credential.

Also aligns two details with those siblings - the enable default is
asserted from swarm-required-services.nix with the metrics pair it
feeds, so that file remains the one place a service host is declared,
and machine is readOnly since its description already calls it a fact
rather than a knob.

nix/host-modules/swarm-otel.nix

@@ -37,14 +37,14 @@ in
   options.services.hyperhive.swarm.otel = {
     enable = lib.mkOption {
       type = lib.types.bool;
-      default = swarmCfg.enableRequiredServices;
+      default = false;
-      defaultText = lib.literalExpression "services.hyperhive.swarm.enableRequiredServices";
       description = ''
         Run the swarm's telemetry collector on this host.
 
-        Derived from `swarm.enableRequiredServices` like the swarm's other
+        Asserted from `swarm.enableRequiredServices` in
-        shared services: a swarm has one of these, and it belongs wherever
+        ./swarm-required-services.nix, with the metrics pair this
-        the shared services live rather than on every hive.
+        collector feeds: a swarm has one of these, and it belongs
+        wherever the shared services live rather than on every hive.
 
         A hive that does not run it still runs its own hive-tier collector
         (`services.hyperhive.otel.enable`) and points it here with
@@ -54,6 +54,7 @@ in
 
     machine = lib.mkOption {
       type = lib.types.str;
+      readOnly = true;
       default = "swarm-otel";
       description = ''
         Name of the nixos-container this collector runs in — also the
@@ -162,6 +163,19 @@ in
       config =
         { ... }:
         {
+          # This tier is the one that resolves an operator-configured
+          # hostname: `otel.endpoint` is an external URL, and reaching it
+          # is the entire reason this container holds a credential. The
+          # `/etc/resolv.conf` nixos-containers copies in is a snapshot
+          # taken once at boot, so without this the upstream export
+          # depends on the host's file having been right at that instant.
+          imports = [
+            (import ./swarm-container-resolver.nix {
+              inherit (config.services.hyperhive.network) bridgeIp;
+              dnsConsumers = [ "opentelemetry-collector.service" ];
+            })
+          ];
+
           system.stateVersion = config.system.stateVersion;
           networking.firewall.enable = false;
           # Keep the host-copied /etc/resolv.conf intact — same reasoning

nix/host-modules/swarm-required-services.nix

@@ -70,6 +70,12 @@ in
     # exactly one still sets it directly, which `mkDefault` allows.
     victoriametrics.enable = lib.mkDefault swarmCfg.enableRequiredServices;
     grafana.enable = lib.mkDefault swarmCfg.enableRequiredServices;
+
+    # The collector that feeds the pair above, and the only tier holding
+    # the upstream credential. Same rule as the rest: once per swarm,
+    # optional, and a hive that is not the service host is a *client* of
+    # it (`swarm.otel.url`) rather than a second one.
+    otel.enable = lib.mkDefault swarmCfg.enableRequiredServices;
   };
 
   # The collector that feeds the pair above (note: no `swarm.` prefix,