move dashboardPort, claudeCodePackage and extraResourceAttributes to deploy.hive-controller

These three are per-host choices that hive-c0re reads and renders into
its agents, so they belong under the hive controller's deploy namespace
rather than swarm-wide:

- c0re.dashboardPort -> deploy.hive-controller.dashboardPort
- c0re.claudeCodePackage -> deploy.hive-controller.claudeCodePackage
  (the claude-login and review-classifier containers on the same host
  keep following it)
- otel.extraResourceAttributes -> deploy.hive-controller.otel.extraResourceAttributes

The old paths stay as mkRenamedOptionModule aliases, now in deploy.nix
with the namespace's other renames. github.enable and the collector port
stay swarm-wide.

docs/swarm/claude-login.md

@@ -7,8 +7,9 @@ agent's harness installs them from there.
 
 Where it runs and how it's enabled: [`services.md`](services.md#claude-login-minter).
 
-The service runs the `claude-code` that `services.hyperhive.swarm.claudeCodePackage`
-pins for agents, and its container's own nixpkgs' where the swarm pins none.
+The service runs the `claude-code` that its host's
+`services.hyperhive.deploy.hive-controller.claudeCodePackage`
+pins for agents, and its container's own nixpkgs' where the host pins none.
 
 ## What happens on a login
 

docs/swarm/review-classifier.md

@@ -145,8 +145,9 @@ config) and an empty directory of its own. The prompt reaches it on stdin as
 one user message in `--input-format stream-json`, so that it can carry content
 blocks (see [Shared context](#shared-context)).
 
-The `claude` is the one `services.hyperhive.swarm.claudeCodePackage` pins for
-agents, or its container's own nixpkgs' where the swarm pins none.
+The `claude` is the one its host's
+`services.hyperhive.deploy.hive-controller.claudeCodePackage` pins for
+agents, or its container's own nixpkgs' where the host pins none.
 
 On the ACP runtime, each classification is one prompt on a new `opencode acp`
 session. Its config and opencode's state live in a directory of its own,