feat(#2007): export per-agent container cpu/mem/disk via otel

hive-c0re already samples each agent container's cgroup load for the
dashboard (stats/container_stats.rs); this rides those gauges out to the
configured OTLP endpoint, reusing the existing services.hyperhive.otel
config (endpoint + auth header) — no new toggle.

- New stats/otel_metrics.rs: exports via the OpenTelemetry Rust SDK (same
  crates as hive-metric) with the semconv container.* metric names +
  container.name attribute so off-the-shelf OTel/Grafana dashboards work,
  plus the hive agent label. container.cpu.time (counter, s, from cumulative
  cpu.stat usage_usec), container.memory.usage, container.memory.usage.limit;
  memory peak / on-disk storage / instantaneous cpu percent stay hyperhive.*
  custom (no semconv equivalent). Observable instruments read a shared
  snapshot an async task refreshes (gather() is async; SDK callbacks sync).
- container_stats: expose cpu_time_usec (cumulative) on ContainerResource.
- The OTLP auth header is loaded onto hive-c0re's own unit via systemd
  LoadCredential and read from $CREDENTIALS_DIRECTORY/otel-headers.
- docs/observability.md documents the host-emitted semconv metrics.

Host-side export, so it covers containers even when their agent is idle.

hive-c0re/src/main.rs

@@ -428,6 +428,11 @@ async fn cmd_serve(
     // poll stays cheap cgroup-only reads. Feeds `disk_bytes` on the LOAD
     // tab. See container_stats::disk_sampler_loop.
     hive_c0re::container_stats::spawn_disk_sampler();
+    // Per-agent container-resource OTEL export: rides the same
+    // cgroup gauges out to the configured OTLP endpoint, reusing the hive
+    // `services.hyperhive.otel` config (endpoint + LoadCredential auth).
+    // No-op when OTEL isn't configured.
+    hive_c0re::otel_metrics::spawn_exporter();
     // build_logs.sqlite vacuum: c0re-side (single db). Failures kept
     // 30d, successes 24h — see `build_logs::vacuum` for the rule.
     hive_c0re::build_logs::spawn_vacuum(&coord);