swarm-otel: the upstream export is a swarm-otel deploy option

The external export is a setting of the swarm collector, so it moves to
services.hyperhive.deploy.swarm-otel.upstream. Renamed:
- otel.endpoint -> upstream.endpoint
- otel.protocol -> upstream.protocol
- otel.headersCredential -> upstream.headersCredential
- otel.collector.upstreamHeaderName -> upstream.headerName
The unreleased otel.upstreamSignals is declared as upstream.signals.

Hosts keep working through the rename warnings. Eval test covers the old
paths reaching the new options. Docs and stale comments point at the
new paths.

nix/host-modules/hive-c0re/default.nix

@@ -145,7 +145,8 @@ in
     #
     # ⚠️ `SSL_CERT_FILE` REPLACES the trust store, and unlike the other
     # consumers of this helper, hive-c0re already makes a *public*-TLS call:
-    # the OTEL exporter reaches whatever `otel.endpoint` names, typically a
+    # the OTEL exporter reaches whatever
+    # `deploy.swarm-otel.upstream.endpoint` names, typically a
     # normal internet host. The bundle is system CAs + the store's root
     # precisely so that path keeps working — narrowing it to the store's root
     # alone would fix a case nobody hits yet and break one that runs today.