hand agents the dashboard port, pinned claude and otel labels at container start

The three values that differ per host (deploy.hive-controller.dashboardPort,
claudeCodePackage and otel.extraResourceAttributes) no longer go into the
meta flake. hive-priv writes them into the container's
/etc/hyperhive-hive-facts with the hive name and domain, and the agent
reads them at boot:

- HIVE_DASHBOARD_PORT reaches every unit through the hive-facts generator;
  the web UI still defaults to 7000 without it.
- `claude` on PATH is a wrapper that runs HYPERHIVE_CLAUDE_CODE_PATH's
  claude when it is there, and the container's own claude-code otherwise.
  The host's serve.json keeps gc-rooting the pinned build.
- OTEL_RESOURCE_ATTRIBUTES moves out of the units' Environment= into a
  boot-time generator, which appends HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES.

The agent options services.hyperhive.agent.claudeCodePath (now a removed
option) and otel.extraResourceAttributes go; only the meta render set them.
render_flake takes no HiveEnv any more, so the memory-cap render test and
render_hive_flake_at, which only existed to vary HiveEnv into the render,
go with it.

Refs #4857

hive-c0re/src/lifecycle/tests.rs

@@ -527,3 +527,39 @@ async fn run_with_deadline_returns_output_of_a_fast_child() {
         .expect("echo finishes");
     assert_eq!(String::from_utf8_lossy(&out.stdout).trim(), "hi");
 }
+
+/// The three per-host values reach the container as facts: the dashboard
+/// port and pinned claude from the hive's config, the OTEL labels from the
+/// daemon's environment.
+#[test]
+fn hive_facts_carry_the_per_host_values() {
+    let hive = HiveEnv {
+        dashboard_port: 7123,
+        claude_code_path: Some("/nix/store/0abc-claude-code".to_owned()),
+        ..HiveEnv::default()
+    };
+    let facts = hive_facts_from(&hive, |name| {
+        (name == "HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES").then(|| "team=a".to_owned())
+    });
+    assert_eq!(facts.dashboard_port, Some(7123));
+    assert_eq!(
+        facts.claude_code_path.as_deref(),
+        Some("/nix/store/0abc-claude-code")
+    );
+    assert_eq!(
+        facts.otel_extra_resource_attributes.as_deref(),
+        Some("team=a")
+    );
+}
+
+/// Unset and empty both leave a fact out, so the agent falls back to its
+/// own default rather than reading an empty value.
+#[test]
+fn hive_facts_leave_unset_values_out() {
+    let facts = hive_facts_from(&HiveEnv::default(), |name| {
+        (name == "HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES").then(String::new)
+    });
+    assert_eq!(facts.claude_code_path, None);
+    assert_eq!(facts.otel_extra_resource_attributes, None);
+    assert_eq!(facts.name, None);
+}