otel: move the generic OTLP environment out of claude's settings

The endpoint, protocol, temporality preference and resource labels were
shipped only inside claude's managed settings json, so they applied to
claude's own process. hive-bash-daemon, hive-mcp-http, hive-matrix-daemon
and hive-forge-notify are systemd *siblings* of claude rather than its
children, so nothing shipped there could ever reach them: `hive-metric`
invoked from a tool call exited with "OTEL_EXPORTER_OTLP_ENDPOINT not
set", which is the honest failure of a value it structurally could not
see.

Declare those variables container-wide in a new agent module instead —
systemd.globalEnvironment for every unit PID 1 starts, environment.variables
for login shells. Both are needed and neither implies the other; NIX_REMOTE
is set both ways for the same reason.

Claude keeps only what is genuinely its own: the telemetry master flag,
the feedback-survey flag, the version label, and which signals it
exports. A different producer in the same container may legitimately
emit only metrics.

The hyperhive.otel.* options move across with them. They have more than
one consumer now, so their home is the OTEL module rather than the
claude one.

docs/observability.md

@@ -231,7 +231,15 @@ for pointing something *else* at a host-local service.
 
 ## Built-in resource labels
 
-Every agent's export includes these resource attributes automatically:
+The OTLP variables (`OTEL_EXPORTER_OTLP_ENDPOINT`, `_PROTOCOL`,
+`OTEL_RESOURCE_ATTRIBUTES`, the temporality preference) are set **container
+wide** — in systemd's `DefaultEnvironment` and in `/etc/profile` — so every
+process in an agent container exports to the hive's collector without any
+per-tool wiring. That covers Claude Code, `hive-metric`, and anything you run
+yourself from a tool call or `hivectl shell`.
+
+Every agent's export therefore includes these resource attributes
+automatically:
 
 | Attribute | Value |
 |-----------|-------|