move dashboardPort, claudeCodePackage and extraResourceAttributes to deploy.hive-controller

These three are per-host choices that hive-c0re reads and renders into
its agents, so they belong under the hive controller's deploy namespace
rather than swarm-wide:

- c0re.dashboardPort -> deploy.hive-controller.dashboardPort
- c0re.claudeCodePackage -> deploy.hive-controller.claudeCodePackage
  (the claude-login and review-classifier containers on the same host
  keep following it)
- otel.extraResourceAttributes -> deploy.hive-controller.otel.extraResourceAttributes

The old paths stay as mkRenamedOptionModule aliases, now in deploy.nix
with the namespace's other renames. github.enable and the collector port
stay swarm-wide.

docs/turn-loop/claude-invocation.md

@@ -32,8 +32,8 @@ to the bus.
 harness unit's PATH. By default that's the `claude-code` in the agent's
 own nixpkgs (the meta flake's `nixpkgs` input) via
 `environment.systemPackages`. Since that's typically a release channel and
-this package moves fast, the operator can pin one swarm-wide with
-`services.hyperhive.swarm.claudeCodePackage`: hive-c0re writes its
+this package moves fast, the operator can pin one per hive with
+`services.hyperhive.deploy.hive-controller.claudeCodePackage`: hive-c0re writes its
 store path into each agent's flake, and `claude` on PATH becomes a symlink to it
 instead of the container's own `claude-code` — so there's only ever one
 `claude` in the container. Agents pick up a new build on their