hand agents the dashboard port, pinned claude and otel labels at container start

The three values that differ per host (deploy.hive-controller.dashboardPort,
claudeCodePackage and otel.extraResourceAttributes) no longer go into the
meta flake. hive-priv writes them into the container's
/etc/hyperhive-hive-facts with the hive name and domain, and the agent
reads them at boot:

- HIVE_DASHBOARD_PORT reaches every unit through the hive-facts generator;
  the web UI still defaults to 7000 without it.
- `claude` on PATH is a wrapper that runs HYPERHIVE_CLAUDE_CODE_PATH's
  claude when it is there, and the container's own claude-code otherwise.
  The host's serve.json keeps gc-rooting the pinned build.
- OTEL_RESOURCE_ATTRIBUTES moves out of the units' Environment= into a
  boot-time generator, which appends HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES.

The agent options services.hyperhive.agent.claudeCodePath (now a removed
option) and otel.extraResourceAttributes go; only the meta render set them.
render_flake takes no HiveEnv any more, so the memory-cap render test and
render_hive_flake_at, which only existed to vary HiveEnv into the render,
go with it.

Refs #4857

nix/agent-modules/default.nix

@@ -28,6 +28,28 @@ let
     which the hive writes before every start, so no agent build sets it.
     Remove the setting.
   '';
+  claudeCodePathRemoved = ''
+    An agent reads the claude-code its hive pins at runtime, from
+    HYPERHIVE_CLAUDE_CODE_PATH in /etc/hyperhive-hive-facts, so no agent build
+    sets it. Pin it host-side with
+    services.hyperhive.deploy.hive-controller.claudeCodePackage.
+  '';
+
+  # `claude` on PATH. A hive that pins a claude-code
+  # (`services.hyperhive.deploy.hive-controller.claudeCodePackage`) hands its
+  # store path over at container start as `HYPERHIVE_CLAUDE_CODE_PATH`, and
+  # the host's system closure keeps it alive: nothing in this container
+  # references it. With no pin, or a path that is not there, this container's
+  # own claude-code runs. `exec -a claude` keeps the bare name in argv[0],
+  # which is how the harness finds its claude child (`find_claude_child`).
+  ownClaude = import ../claude-code-no-alsa.nix lib pkgs.claude-code;
+  claude = pkgs.writeShellScriptBin "claude" ''
+    pinned=''${HYPERHIVE_CLAUDE_CODE_PATH:-}
+    if [ -n "$pinned" ] && [ -x "$pinned/bin/claude" ]; then
+      exec -a claude "$pinned/bin/claude" "$@"
+    fi
+    exec -a claude ${ownClaude}/bin/claude "$@"
+  '';
 in
 {
   imports = [
@@ -68,6 +90,12 @@ in
       "agent"
       "claudeMemoryMaxBytes"
     ] memoryMaxBytesRemoved)
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "agent"
+      "claudeCodePath"
+    ] claudeCodePathRemoved)
   ];
 
   options.services.hyperhive.agent.icon = lib.mkOption {
@@ -87,33 +115,6 @@ in
     '';
   };
 
-  options.services.hyperhive.agent.claudeCodePath = lib.mkOption {
-    type = lib.types.nullOr lib.types.str;
-    default = null;
-    example = "/nix/store/…-claude-code-2.1.220";
-    description = ''
-      Store path of the `claude-code` this agent runs, or `null` (the
-      default) to use the `claude-code` from the container's own
-      nixpkgs.
-
-      Set by the generated meta flake when the operator sets
-      `services.hyperhive.deploy.hive-controller.claudeCodePackage` host-side, so a hive
-      can run a claude built from a *different* nixpkgs than the one
-      its agents evaluate against — a release channel can trail
-      unstable by weeks on this one package. It arrives as a path and
-      not a package because agents share the host's `/nix/store`, so
-      the build is already reachable here with its whole closure and
-      has nothing to travel.
-
-      When set, `claude` on PATH is a symlink to this path's
-      `bin/claude` and the container's own `claude-code` is dropped, so
-      there is only ever one claude in the container. Note that neither
-      the symlink nor anything else in the container's closure *refers*
-      to the target — keeping it alive is the host's job, see
-      `services.hyperhive.deploy.hive-controller.claudeCodePackage`.
-    '';
-  };
-
   config = {
     assertions = [
       # Guard the inputs-routed-as-output pattern: the agent flake.nix is
@@ -240,28 +241,7 @@ in
       config.services.hyperhive.agent.packages.hive-metric
     ]
     ++ [
-      (
-        if config.services.hyperhive.agent.claudeCodePath == null then
-          import ../claude-code-no-alsa.nix lib pkgs.claude-code
-        else
-          # Host-pinned claude: a symlink farm around a path the
-          # container was handed as text. It has to be a derivation —
-          # `environment.systemPackages` coerces a store-path *string*
-          # with `toDerivation`, i.e. `builtins.storePath`, which pure
-          # evaluation rejects (`systemd.services.*.path` does the same,
-          # which is why the harness gets this via PATH like everything
-          # else rather than a unit-level entry). Interpolating the path
-          # into the builder is just text, so it evaluates anywhere.
-          #
-          # The symlink registers no store reference — the target isn't
-          # among this derivation's inputs, so nothing here keeps the
-          # binary alive. That is deliberate and it is the host's job:
-          # see `services.hyperhive.deploy.hive-controller.claudeCodePackage`.
-          pkgs.runCommandLocal "claude-code-pinned" { } ''
-            mkdir -p "$out/bin"
-            ln -s ${config.services.hyperhive.agent.claudeCodePath}/bin/claude "$out/bin/claude"
-          ''
-      )
+      claude
     ]
     ++ (with pkgs; [
       bashInteractive