refactor(#2693): null, not "", for the unpinned claude-code

mara on PR #2769: "make the default null instead of special casing """.

`claude_code_path` was a `String` whose empty value meant "no host-level
pin". That is a sentinel doing an `Option`'s job — the same shape argus
and mara already rejected on #2755's weights, and the same
empty-field cruft mara called out on #2756.

So it is `Option<String>` end to end:

- host module: `claudeCodePath` evaluates to `null` when
  `claudeCodePackage` is unset, so `serve.json` carries JSON `null`
  rather than `""`.
- `Coordinator` + `HiveEnv`: `Option<String>`, defaulting to `None`.
- `render_flake`/`render_flake_with_lookup`: `Option<&str>`, and the
  emission is an `if let Some(path)` instead of an `is_empty()` guard.
- agent module: `hyperhive.claudeCodePath` is `nullOr str`, default
  `null`.

Behaviour is unchanged in both directions; only the way "unset" is
spelled moves. The `builtins.hasContext` assertion still guards the
pinned case (short-circuited by the null check, so an unpinned hive
never evaluates it).

16/16 `meta::` tests, clippy clean, `nix fmt` no-op, `nix build .#docs`
green.

nix/host-modules/hive-c0re/default.nix

@@ -59,7 +59,7 @@ let
     fi
   '';
 
-  # Store path of the `claude-code` every agent runs, or "" for "each
+  # Store path of the `claude-code` every agent runs, or null for "each
   # agent keeps the one out of its own nixpkgs". meta.rs writes it into
   # each agent's generated flake as a plain string literal, and the agent
   # module puts its `bin/` on the harness PATH.
@@ -73,7 +73,7 @@ let
   # do not hand meta.rs the path by a route that drops it. The failure
   # mode is a garbage-collected `claude` and a hive that can't take a
   # turn, weeks after the commit that caused it.
-  claudeCodePath = if cfg.claudeCodePackage == null then "" else "${cfg.claudeCodePackage}";
+  claudeCodePath = if cfg.claudeCodePackage == null then null else "${cfg.claudeCodePackage}";
 
   # The `hive-c0re serve` config JSON. Keys are snake_case to match the
   # `ServeConfig` serde shape the daemon deserialises (the