feat(#2007): export per-agent container cpu/mem/disk via otel

hive-c0re already samples each agent container's cgroup load for the
dashboard (stats/container_stats.rs); this rides those gauges out to the
configured OTLP endpoint, reusing the existing services.hyperhive.otel
config (endpoint + auth header) — no new toggle.

- New stats/otel_metrics.rs: exports via the OpenTelemetry Rust SDK (same
  crates as hive-metric) with the semconv container.* metric names +
  container.name attribute so off-the-shelf OTel/Grafana dashboards work,
  plus the hive agent label. container.cpu.time (counter, s, from cumulative
  cpu.stat usage_usec), container.memory.usage, container.memory.usage.limit;
  memory peak / on-disk storage / instantaneous cpu percent stay hyperhive.*
  custom (no semconv equivalent). Observable instruments read a shared
  snapshot an async task refreshes (gather() is async; SDK callbacks sync).
- container_stats: expose cpu_time_usec (cumulative) on ContainerResource.
- The OTLP auth header is loaded onto hive-c0re's own unit via systemd
  LoadCredential and read from $CREDENTIALS_DIRECTORY/otel-headers.
- docs/observability.md documents the host-emitted semconv metrics.

Host-side export, so it covers containers even when their agent is idle.

nix/host-modules/hive-c0re/default.nix

@@ -157,6 +157,15 @@ in
         RuntimeDirectoryPreserve = "yes";
         StateDirectory = "hyperhive";
         StateDirectoryMode = "0750";
+        # OTEL auth-header secret, loaded onto hive-c0re's own unit so its
+        # per-agent container-resource metrics exporter can read it
+        # at $CREDENTIALS_DIRECTORY/otel-headers — via systemd, not a world
+        # path. Same secret the agent containers get (forwarded there via
+        # nspawn --load-credential); this just also hands it to c0re itself.
+        # Empty list (no credential) when otel is off or no header is set.
+        LoadCredential = lib.optional (
+          config.services.hyperhive.otel.enable && config.services.hyperhive.otel.headersCredential != null
+        ) "otel-headers:${config.services.hyperhive.otel.headersCredential}";
         # Sandboxing. hive-c0re is unprivileged (runs as hive-core, never
         # setuid), makes HTTP requests to forge/matrix/Anthropic (keeps INET),
         # and delegates all privileged ops to hive-priv via a Unix socket.