move dashboardPort, claudeCodePackage and extraResourceAttributes to deploy.hive-controller

These three are per-host choices that hive-c0re reads and renders into
its agents, so they belong under the hive controller's deploy namespace
rather than swarm-wide:

- c0re.dashboardPort -> deploy.hive-controller.dashboardPort
- c0re.claudeCodePackage -> deploy.hive-controller.claudeCodePackage
  (the claude-login and review-classifier containers on the same host
  keep following it)
- otel.extraResourceAttributes -> deploy.hive-controller.otel.extraResourceAttributes

The old paths stay as mkRenamedOptionModule aliases, now in deploy.nix
with the namespace's other renames. github.enable and the collector port
stay swarm-wide.

nix/module-eval/swarm-services-switch.nix

@@ -99,11 +99,11 @@ let
     deploy.builder.enable = false;
   };
 
-  # Same, with the claude-code build the agents run pinned for the swarm. Any
+  # Same, with the claude-code build the agents run pinned on this host. Any
   # package serves: only the path the containers are pointed at is read.
   swarmServicesPinnedClaude = hiveWithController {
     deploy.allSwarmServices = true;
-    swarm.claudeCodePackage = pkgs.hello;
+    deploy.hive-controller.claudeCodePackage = pkgs.hello;
   };
 
   # Same, with one of those services placed on another host. Every derivation
@@ -284,7 +284,7 @@ let
       # The CLI is the one the agents run, not the container's own nixpkgs'.
       # Unpinned is the control: it falls back to the container's own `claude-code`.
       # serve.json is what hive-c0re renders every agent's `claudeCodePath` from.
-      name = "the agents, the claude login minter and the review classifier run the claude-code the swarm pins";
+      name = "the agents, the claude login minter and the review classifier run the claude-code this host pins";
       ok =
         let
           claudeOf =