move dashboardPort, claudeCodePackage and extraResourceAttributes to deploy.hive-controller

These three are per-host choices that hive-c0re reads and renders into
its agents, so they belong under the hive controller's deploy namespace
rather than swarm-wide:

- c0re.dashboardPort -> deploy.hive-controller.dashboardPort
- c0re.claudeCodePackage -> deploy.hive-controller.claudeCodePackage
  (the claude-login and review-classifier containers on the same host
  keep following it)
- otel.extraResourceAttributes -> deploy.hive-controller.otel.extraResourceAttributes

The old paths stay as mkRenamedOptionModule aliases, now in deploy.nix
with the namespace's other renames. github.enable and the collector port
stay swarm-wide.

nix/host-modules/hive-c0re/default.nix

@@ -12,7 +12,7 @@
 }:
 let
   cfg = config.services.hyperhive.c0re;
-  swarmCfg = config.services.hyperhive.swarm;
+  controllerCfg = config.services.hyperhive.deploy.hive-controller;
 
   # `/run/hyperhive`'s mode. Held in one place because whichever of the two
   # units below activates first creates the directory, so they cannot be
@@ -111,8 +111,8 @@ let
     # anything that drops it. The failure mode is a garbage-collected
     # `claude` and a hive that can't take a turn, weeks after the commit
     # that caused it.
-    claude_code_path = swarmCfg.claudeCodePackage;
-    dashboard_port = swarmCfg.dashboardPort;
+    claude_code_path = controllerCfg.claudeCodePackage;
+    dashboard_port = controllerCfg.dashboardPort;
     agent_cpu_quota = cfg.agentCpuQuota;
     agent_memory_max = cfg.agentMemoryMax;
     agent_cpu_weight = cfg.agentCpuWeight;
@@ -164,10 +164,10 @@ in
         # `claude`, at whatever unrelated moment the gc runs. Cheap
         # enough to just check.
         assertion =
-          swarmCfg.claudeCodePackage == null
-          || builtins.hasContext (builtins.toJSON swarmCfg.claudeCodePackage);
+          controllerCfg.claudeCodePackage == null
+          || builtins.hasContext (builtins.toJSON controllerCfg.claudeCodePackage);
         message = ''
-          services.hyperhive.swarm.claudeCodePackage lost its store
+          services.hyperhive.deploy.hive-controller.claudeCodePackage lost its store
           context on the way into /etc/hyperhive/serve.json, so the
           package is no longer gc-rooted by the system closure and
           `nix-collect-garbage` may delete the claude every agent runs.

nix/host-modules/hive-c0re/environment.nix

@@ -72,15 +72,16 @@ in
   HYPERHIVE_GITHUB_DISABLED = "1";
 }
 // lib.optionalAttrs config.services.hyperhive.otel.enable (
-  # OTEL config (`swarm.hiveOtel`, gated on this hive's `otel.enable`) ->
-  # read by meta.rs::otel_config and injected as build-time
-  # `services.hyperhive.agent.otel.*` into every agent.
+  # OTEL config (`swarm.hiveOtel`, `deploy.hive-controller.otel`, gated on
+  # this hive's `otel.enable`) -> read by meta.rs::otel_config and injected
+  # as build-time `services.hyperhive.agent.otel.*` into every agent.
   # Endpoint presence is the enable signal on the meta side; the
   # optional fields are only emitted when set so absent values
   # don't render no-op env lines.
   let
     otel = config.services.hyperhive.otel;
     hiveOtel = config.services.hyperhive.swarm.hiveOtel;
+    controllerOtel = config.services.hyperhive.deploy.hive-controller.otel;
     # The first hop, this hive's own collector, under the two spellings its
     # two kinds of caller need. Agents get the swarm-wide name, so their
     # builds carry nothing hive-specific; this daemon gets the bridge
@@ -115,8 +116,8 @@ in
     # what has to honour it (see nix/host-modules/otel.nix).
     HYPERHIVE_OTEL_PROTOCOL = "http/protobuf";
   }
-  // lib.optionalAttrs (hiveOtel.extraResourceAttributes != "") {
-    HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES = hiveOtel.extraResourceAttributes;
+  // lib.optionalAttrs (controllerOtel.extraResourceAttributes != "") {
+    HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES = controllerOtel.extraResourceAttributes;
   }
   # HYPERHIVE_OTEL_HEADERS_CREDENTIAL is deliberately NOT emitted, and
   # its absence is the security half of this design: that variable would

nix/host-modules/hive-c0re/options.nix

@@ -3,29 +3,19 @@
 # `nixosModules.default` wires to its own outputs (they carry no
 # in-module defaults; see ../../../flake.nix). The read-only
 # `servedFrontend` option lives in ./theme.nix with the stylix wiring
-# that computes it. The swarm-wide values the meta-flake render hands
-# every agent are declared here too, under `services.hyperhive.swarm`.
+# that computes it. The hive's own values the meta-flake render hands
+# its agents are declared here too, under
+# `services.hyperhive.deploy.hive-controller`.
 {
   pkgs,
   lib,
   ...
 }:
-let
-  renamedToSwarm =
-    name:
-    lib.mkRenamedOptionModule
-      [ "services" "hyperhive" "c0re" name ]
-      [ "services" "hyperhive" "swarm" name ];
-in
 {
   imports = [
     (lib.mkRemovedOptionModule [ "services" "hyperhive" "c0re" "managerToplevel" ] ''
       Every agent, ruth included, builds from `agentBaseToplevel`. Remove this definition.
     '')
-  ]
-  ++ map renamedToSwarm [
-    "claudeCodePackage"
-    "dashboardPort"
   ];
 
   options.services.hyperhive.c0re = {
@@ -340,19 +330,19 @@ in
     };
   };
 
-  # What every agent in the swarm is handed through the meta-flake render,
-  # whichever hive builds it. Swarm-wide so that no hive's agents differ.
-  options.services.hyperhive.swarm = {
+  # What this hive hands its own agents through the meta-flake render. Per
+  # host, so two hives may set them differently.
+  options.services.hyperhive.deploy.hive-controller = {
     claudeCodePackage = lib.mkOption {
       type = lib.types.nullOr lib.types.package;
       default = null;
       example = lib.literalExpression "inputs.nixpkgs-unstable.legacyPackages.x86_64-linux.claude-code";
       description = ''
-        The `claude-code` build every agent runs, or `null` (the
+        The `claude-code` build every agent on this hive runs, or `null` (the
         default) to leave each agent on the `claude-code` from its own
         nixpkgs — i.e. whatever `c0re.nixpkgsFlake` resolves to.
 
-        This is the one binary the whole swarm is built around, and it
+        This is the one binary the whole hive is built around, and it
         moves fast enough that a release channel routinely trails
         unstable by weeks on it. An agent cannot fix that for itself:
         agents evaluate against the single nixpkgs hive-c0re injects,
@@ -391,7 +381,7 @@ in
     dashboardPort = lib.mkOption {
       type = lib.types.port;
       default = 7000;
-      description = "TCP port every hive's hive-c0re dashboard listens on.";
+      description = "TCP port this hive's hive-c0re dashboard listens on.";
     };
   };
 }