move dashboardPort, claudeCodePackage and extraResourceAttributes to deploy.hive-controller

These three are per-host choices that hive-c0re reads and renders into
its agents, so they belong under the hive controller's deploy namespace
rather than swarm-wide:

- c0re.dashboardPort -> deploy.hive-controller.dashboardPort
- c0re.claudeCodePackage -> deploy.hive-controller.claudeCodePackage
  (the claude-login and review-classifier containers on the same host
  keep following it)
- otel.extraResourceAttributes -> deploy.hive-controller.otel.extraResourceAttributes

The old paths stay as mkRenamedOptionModule aliases, now in deploy.nix
with the namespace's other renames. github.enable and the collector port
stay swarm-wide.

docs/process/conventions.md

@@ -11,7 +11,7 @@ exist because something already went wrong without them.
 - `MAX_AGENT_NAME` in `hive-c0re/src/lifecycle/mod.rs` enforces the cap.
 - Per-agent web UI port = `WEB_PORT_BASE + FNV1a(name) % WEB_PORT_RANGE`
   (8100..8999) for every agent; dashboard
-  `services.hyperhive.swarm.dashboardPort` (default 7000).
+  `services.hyperhive.deploy.hive-controller.dashboardPort` (default 7000).
 
 ## Hive identity (label + domain + display names)
 

docs/process/gotchas.md

@@ -140,7 +140,7 @@ _different_ nixpkgs by itself: a container only ever sees the one
 nixpkgs the meta flake injects, so an `agent.nix` naming the host's
 `nixpkgs-unstable` has nothing to name. A release channel can trail
 unstable by weeks on this package, which is what
-`services.hyperhive.swarm.claudeCodePackage` is for — set it host-side
+`services.hyperhive.deploy.hive-controller.claudeCodePackage` is for — set it host-side
 and every agent runs that build.
 
 What crosses is the **store path**, not the derivation. Containers
@@ -228,7 +228,7 @@ agent (different hash → different port) and rebuilding. No state
 file, no probing, no port-allocation drift — the value is
 reproducible from just the name. Every agent hashes into
 8100..8999 via the same FNV-1a; dashboard
-at `services.hyperhive.swarm.dashboardPort` (default 7000).
+at `services.hyperhive.deploy.hive-controller.dashboardPort` (default 7000).
 
 ### Restart races on TCP bind