hand agents the dashboard port, pinned claude and otel labels at container start

The three values that differ per host (deploy.hive-controller.dashboardPort,
claudeCodePackage and otel.extraResourceAttributes) no longer go into the
meta flake. hive-priv writes them into the container's
/etc/hyperhive-hive-facts with the hive name and domain, and the agent
reads them at boot:

- HIVE_DASHBOARD_PORT reaches every unit through the hive-facts generator;
  the web UI still defaults to 7000 without it.
- `claude` on PATH is a wrapper that runs HYPERHIVE_CLAUDE_CODE_PATH's
  claude when it is there, and the container's own claude-code otherwise.
  The host's serve.json keeps gc-rooting the pinned build.
- OTEL_RESOURCE_ATTRIBUTES moves out of the units' Environment= into a
  boot-time generator, which appends HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES.

The agent options services.hyperhive.agent.claudeCodePath (now a removed
option) and otel.extraResourceAttributes go; only the meta render set them.
render_flake takes no HiveEnv any more, so the memory-cap render test and
render_hive_flake_at, which only existed to vary HiveEnv into the render,
go with it.

Refs #4857

nix/host-modules/hive-c0re/default.nix

@@ -110,9 +110,9 @@ let
     # in whole rather than interpolated — that is also the ONLY thing
     # gc-rooting it: the resulting string carries store context, so this
     # /etc entry genuinely references the package and the host's system
-    # closure holds it alive. Nothing container-side can — meta.rs writes
-    # the path into each agent's generated flake as a plain string
-    # literal, and text is not a reference. Hence the assertion below: do
+    # closure holds it alive. Nothing container-side can: hive-c0re hands
+    # the path to each container as text (`HYPERHIVE_CLAUDE_CODE_PATH`),
+    # and text is not a reference. Hence the assertion below: do
     # NOT discard this context, and do not route the path through
     # anything that drops it. The failure mode is a garbage-collected
     # `claude` and a hive that can't take a turn, weeks after the commit

nix/host-modules/hive-c0re/options.nix

@@ -326,8 +326,9 @@
     };
   };
 
-  # What this hive hands its own agents through the meta-flake render. Per
-  # host, so two hives may set them differently.
+  # What this hive hands its own agents at container start, through
+  # `/etc/hyperhive-hive-facts`. Per host, so two hives may set them
+  # differently.
   options.services.hyperhive.deploy.hive-controller = {
     claudeCodePackage = lib.mkOption {
       type = lib.types.nullOr lib.types.package;
@@ -350,22 +351,22 @@
         What travels into the container is the **store path**, not the
         derivation: agents share the host's `/nix/store`, so the binary
         and its full closure are already reachable there — nothing
-        needs rebuilding or copying. hive-c0re writes the path into
-        each agent's generated flake as a plain string literal (a bare
-        path fed to `lib.types.package` would run `builtins.storePath`,
-        which is illegal under pure evaluation) and the agent module
-        puts its `bin/` on the harness's PATH.
+        needs rebuilding or copying. hive-c0re hands the path to each
+        container at start as `HYPERHIVE_CLAUDE_CODE_PATH`, and the agent's
+        `claude` on PATH runs it, or the container's own `claude-code` when
+        the variable is absent or names nothing. A change reaches an agent
+        at its next container start, not through a rebuild.
 
         The flip side of a plain string is that nothing in the agent's
         own closure refers to it, so the container cannot keep it
         alive. The **host** does that instead: this package is
         interpolated into `/etc/hyperhive/serve.json`, which puts it in
-        the host's system closure — so it is gc-rooted by the running
-        generation for exactly as long as that generation is the one
-        the agents were rendered from. The cost is that
-        `nix-collect-garbage` cannot reclaim an old `claude-code` until
-        every agent has been rebuilt past it and the old generations
-        are gone.
+        the host's system closure, so it is gc-rooted by the running
+        generation. ⚠️ An agent started under an older generation keeps
+        that generation's path until its next start, and only the old
+        generation roots it: collect old generations after restarting
+        the agents, or an agent still running the old path falls back to
+        its own `claude-code` at its next `claude` spawn.
 
         The swarm's `swarm-claude-login` and `swarm-review-classifier`
         containers, where this host runs them, follow the same pin and
@@ -377,7 +378,11 @@
     dashboardPort = lib.mkOption {
       type = lib.types.port;
       default = 7000;
-      description = "TCP port this hive's hive-c0re dashboard listens on.";
+      description = ''
+        TCP port this hive's hive-c0re dashboard listens on. Agents get it
+        at container start as `HIVE_DASHBOARD_PORT`, for their web UI's
+        links back to the dashboard.
+      '';
     };
   };
 }