hand agents the dashboard port, pinned claude and otel labels at container start

The three values that differ per host (deploy.hive-controller.dashboardPort,
claudeCodePackage and otel.extraResourceAttributes) no longer go into the
meta flake. hive-priv writes them into the container's
/etc/hyperhive-hive-facts with the hive name and domain, and the agent
reads them at boot:

- HIVE_DASHBOARD_PORT reaches every unit through the hive-facts generator;
  the web UI still defaults to 7000 without it.
- `claude` on PATH is a wrapper that runs HYPERHIVE_CLAUDE_CODE_PATH's
  claude when it is there, and the container's own claude-code otherwise.
  The host's serve.json keeps gc-rooting the pinned build.
- OTEL_RESOURCE_ATTRIBUTES moves out of the units' Environment= into a
  boot-time generator, which appends HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES.

The agent options services.hyperhive.agent.claudeCodePath (now a removed
option) and otel.extraResourceAttributes go; only the meta render set them.
render_flake takes no HiveEnv any more, so the memory-cap render test and
render_hive_flake_at, which only existed to vary HiveEnv into the render,
go with it.

Refs #4857

hive-c0re/src/lifecycle/host_config.rs

@@ -25,7 +25,7 @@ use super::{
 pub async fn write_dropins(name: &str, hive: &HiveEnv, paths: &AgentPaths) -> Result<()> {
     validate(name)?;
     let container = container_name(name);
-    set_nspawn_flags(&container, &paths.agent, &paths.claude, &paths.notes).await?;
+    set_nspawn_flags(&container, hive, &paths.agent, &paths.claude, &paths.notes).await?;
     hand_permissions(name, &paths.agent);
     if let Some((cpu_quota, memory_max)) = stage_limits(
         name,
@@ -496,6 +496,7 @@ fn queue_agent_credentials(agent_name: &str, dir: Option<&Path>) -> Vec<Credenti
 )]
 async fn set_nspawn_flags(
     container: &str,
+    hive: &HiveEnv,
     runtime_dir: &Path,
     claude_dir: &Path,
     notes_dir: &Path,
@@ -669,7 +670,7 @@ async fn set_nspawn_flags(
         &binds,
         isolation,
         &load_creds,
-        super::hive_facts_from_env(),
+        super::hive_facts(hive),
     )
     .await
 }

hive-c0re/src/lifecycle/mod.rs

@@ -169,14 +169,27 @@ pub fn network_isolation_from_env() -> Result<hive_priv_sock::NetworkIsolation>
     network_isolation_from_vars(bridge.as_deref(), subnet.as_deref())
 }
 
-/// The hive's facts every container is handed at runtime, from hive-c0re's
-/// own unit environment (`nix/host-modules/hive-c0re/environment.nix`). An
-/// unset or empty variable is `None`.
-fn hive_facts_from_env() -> hive_priv_sock::HiveFacts {
-    let read = |name: &str| std::env::var(name).ok().filter(|v| !v.is_empty());
+/// The hive's facts every container is handed at runtime, so that no agent
+/// build carries a value that differs between hosts. The name, domain and
+/// OTEL resource labels come from hive-c0re's own unit environment
+/// (`nix/host-modules/hive-c0re/environment.nix`), where an unset or empty
+/// variable is `None`; the dashboard port and pinned claude from `hive`.
+fn hive_facts(hive: &HiveEnv) -> hive_priv_sock::HiveFacts {
+    hive_facts_from(hive, |name| std::env::var(name).ok())
+}
+
+/// [`hive_facts`] over a given environment lookup, for tests.
+fn hive_facts_from(
+    hive: &HiveEnv,
+    var: impl Fn(&str) -> Option<String>,
+) -> hive_priv_sock::HiveFacts {
+    let read = |name: &str| var(name).filter(|v| !v.is_empty());
     hive_priv_sock::HiveFacts {
         name: read("HYPERHIVE_HIVE_NAME"),
         domain: read("HYPERHIVE_HIVE_DOMAIN"),
+        dashboard_port: Some(hive.dashboard_port),
+        claude_code_path: hive.claude_code_path.clone(),
+        otel_extra_resource_attributes: read("HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES"),
     }
 }
 

hive-c0re/src/lifecycle/tests.rs

@@ -527,3 +527,39 @@ async fn run_with_deadline_returns_output_of_a_fast_child() {
         .expect("echo finishes");
     assert_eq!(String::from_utf8_lossy(&out.stdout).trim(), "hi");
 }
+
+/// The three per-host values reach the container as facts: the dashboard
+/// port and pinned claude from the hive's config, the OTEL labels from the
+/// daemon's environment.
+#[test]
+fn hive_facts_carry_the_per_host_values() {
+    let hive = HiveEnv {
+        dashboard_port: 7123,
+        claude_code_path: Some("/nix/store/0abc-claude-code".to_owned()),
+        ..HiveEnv::default()
+    };
+    let facts = hive_facts_from(&hive, |name| {
+        (name == "HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES").then(|| "team=a".to_owned())
+    });
+    assert_eq!(facts.dashboard_port, Some(7123));
+    assert_eq!(
+        facts.claude_code_path.as_deref(),
+        Some("/nix/store/0abc-claude-code")
+    );
+    assert_eq!(
+        facts.otel_extra_resource_attributes.as_deref(),
+        Some("team=a")
+    );
+}
+
+/// Unset and empty both leave a fact out, so the agent falls back to its
+/// own default rather than reading an empty value.
+#[test]
+fn hive_facts_leave_unset_values_out() {
+    let facts = hive_facts_from(&HiveEnv::default(), |name| {
+        (name == "HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES").then(String::new)
+    });
+    assert_eq!(facts.claude_code_path, None);
+    assert_eq!(facts.otel_extra_resource_attributes, None);
+    assert_eq!(facts.name, None);
+}