hand agents the dashboard port, pinned claude and otel labels at container start

The three values that differ per host (deploy.hive-controller.dashboardPort,
claudeCodePackage and otel.extraResourceAttributes) no longer go into the
meta flake. hive-priv writes them into the container's
/etc/hyperhive-hive-facts with the hive name and domain, and the agent
reads them at boot:

- HIVE_DASHBOARD_PORT reaches every unit through the hive-facts generator;
  the web UI still defaults to 7000 without it.
- `claude` on PATH is a wrapper that runs HYPERHIVE_CLAUDE_CODE_PATH's
  claude when it is there, and the container's own claude-code otherwise.
  The host's serve.json keeps gc-rooting the pinned build.
- OTEL_RESOURCE_ATTRIBUTES moves out of the units' Environment= into a
  boot-time generator, which appends HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES.

The agent options services.hyperhive.agent.claudeCodePath (now a removed
option) and otel.extraResourceAttributes go; only the meta render set them.
render_flake takes no HiveEnv any more, so the memory-cap render test and
render_hive_flake_at, which only existed to vary HiveEnv into the render,
go with it.

Refs #4857

hive-priv-sock/src/lib.rs

@@ -187,6 +187,15 @@ pub struct HiveFacts {
     pub name: Option<String>,
     /// `HYPERHIVE_HIVE_DOMAIN`: the hive's DNS domain.
     pub domain: Option<String>,
+    /// `HIVE_DASHBOARD_PORT`: the port this hive's dashboard listens on.
+    pub dashboard_port: Option<u16>,
+    /// `HYPERHIVE_CLAUDE_CODE_PATH`: store path of the `claude-code` the
+    /// hive pins for its agents. The host's system closure keeps it alive;
+    /// the container only gets the path.
+    pub claude_code_path: Option<String>,
+    /// `HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES`: comma-separated `k=v`
+    /// entries the agent appends to its `OTEL_RESOURCE_ATTRIBUTES`.
+    pub otel_extra_resource_attributes: Option<String>,
 }
 
 /// Wall-clock bound hive-priv puts on one [`PrivRequest::MeasureAgentDisk`]