hand agents the dashboard port, pinned claude and otel labels at container start

The three values that differ per host (deploy.hive-controller.dashboardPort,
claudeCodePackage and otel.extraResourceAttributes) no longer go into the
meta flake. hive-priv writes them into the container's
/etc/hyperhive-hive-facts with the hive name and domain, and the agent
reads them at boot:

- HIVE_DASHBOARD_PORT reaches every unit through the hive-facts generator;
  the web UI still defaults to 7000 without it.
- `claude` on PATH is a wrapper that runs HYPERHIVE_CLAUDE_CODE_PATH's
  claude when it is there, and the container's own claude-code otherwise.
  The host's serve.json keeps gc-rooting the pinned build.
- OTEL_RESOURCE_ATTRIBUTES moves out of the units' Environment= into a
  boot-time generator, which appends HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES.

The agent options services.hyperhive.agent.claudeCodePath (now a removed
option) and otel.extraResourceAttributes go; only the meta render set them.
render_flake takes no HiveEnv any more, so the memory-cap render test and
render_hive_flake_at, which only existed to vary HiveEnv into the render,
go with it.

Refs #4857

docs/scheduler/observability.md

@@ -190,7 +190,7 @@ two-tier architecture, the security model, and how the options interact.
 
 The harness sets the OTLP variables (`OTEL_EXPORTER_OTLP_ENDPOINT`, `_PROTOCOL`,
 `OTEL_RESOURCE_ATTRIBUTES`, the temporality preference) **container
-wide** — in systemd's `DefaultEnvironment` and in `/etc/profile` — so every
+wide**, for every unit and in `/etc/profile`, so every
 process in an agent container exports to the hive's collector without any
 per-tool wiring. That covers Claude Code, `hive-metric`, and anything you run
 yourself from a tool call or a shell you open in the container.
@@ -209,8 +209,9 @@ the push (see [Authenticated ingest](#authenticated-ingest)). The container
 doesn't set it.
 
 Append additional labels for one hive via `extraResourceAttributes` (see
-option reference above); pass custom per-data-point labels with
-`hive-metric --labels` (see below).
+option reference above). Agents get them at container start, so a change
+reaches an agent at its next start, not through a rebuild. Pass custom
+per-data-point labels with `hive-metric --labels` (see below).
 
 ## Log severity