move dashboardPort, claudeCodePackage and extraResourceAttributes to deploy.hive-controller

These three are per-host choices that hive-c0re reads and renders into
its agents, so they belong under the hive controller's deploy namespace
rather than swarm-wide:

- c0re.dashboardPort -> deploy.hive-controller.dashboardPort
- c0re.claudeCodePackage -> deploy.hive-controller.claudeCodePackage
  (the claude-login and review-classifier containers on the same host
  keep following it)
- otel.extraResourceAttributes -> deploy.hive-controller.otel.extraResourceAttributes

The old paths stay as mkRenamedOptionModule aliases, now in deploy.nix
with the namespace's other renames. github.enable and the collector port
stay swarm-wide.

docs/process/gotchas.md

@@ -140,7 +140,7 @@ _different_ nixpkgs by itself: a container only ever sees the one
 nixpkgs the meta flake injects, so an `agent.nix` naming the host's
 `nixpkgs-unstable` has nothing to name. A release channel can trail
 unstable by weeks on this package, which is what
-`services.hyperhive.swarm.claudeCodePackage` is for — set it host-side
+`services.hyperhive.deploy.hive-controller.claudeCodePackage` is for — set it host-side
 and every agent runs that build.
 
 What crosses is the **store path**, not the derivation. Containers
@@ -228,7 +228,7 @@ agent (different hash → different port) and rebuilding. No state
 file, no probing, no port-allocation drift — the value is
 reproducible from just the name. Every agent hashes into
 8100..8999 via the same FNV-1a; dashboard
-at `services.hyperhive.swarm.dashboardPort` (default 7000).
+at `services.hyperhive.deploy.hive-controller.dashboardPort` (default 7000).
 
 ### Restart races on TCP bind