refactor(#2754): make the container weights Option, not a 0 sentinel

Encoding "not configured" as weight 0 worked (the writer omitted the
line) but the type lied: 0 is not a legal cgroup v2 weight, and every
reader had to know the sentinel. Use Option<u32> end to end instead —
wire type, priv_client, HiveEnv, drop-in writer — so "unset" is a state
of the type rather than a magic value.

The nix options become nullOr, keeping their default of 80; null now
expresses "leave the setting out of the drop-in entirely" declaratively,
which is the useful shape on a host whose IO scheduler ignores
io.weight anyway.

Backward compat is unchanged: the fields stay #[serde(default)], so a
request from an older hive-c0re deserialises to None and reproduces the
pre-weights drop-in byte for byte. The test that pins that now passes
None instead of 0.

hive-c0re/src/priv_client.rs

@@ -174,8 +174,8 @@ pub async fn write_resource_limits(
     container: &str,
     memory_max: &str,
     cpu_quota: &str,
-    cpu_weight: u32,
-    io_weight: u32,
+    cpu_weight: Option<u32>,
+    io_weight: Option<u32>,
 ) -> Result<()> {
     ok(call(&PrivRequest::WriteResourceLimits {
         container: container.to_owned(),