hand agents the dashboard port, pinned claude and otel labels at container start

The three values that differ per host (deploy.hive-controller.dashboardPort,
claudeCodePackage and otel.extraResourceAttributes) no longer go into the
meta flake. hive-priv writes them into the container's
/etc/hyperhive-hive-facts with the hive name and domain, and the agent
reads them at boot:

- HIVE_DASHBOARD_PORT reaches every unit through the hive-facts generator;
  the web UI still defaults to 7000 without it.
- `claude` on PATH is a wrapper that runs HYPERHIVE_CLAUDE_CODE_PATH's
  claude when it is there, and the container's own claude-code otherwise.
  The host's serve.json keeps gc-rooting the pinned build.
- OTEL_RESOURCE_ATTRIBUTES moves out of the units' Environment= into a
  boot-time generator, which appends HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES.

The agent options services.hyperhive.agent.claudeCodePath (now a removed
option) and otel.extraResourceAttributes go; only the meta render set them.
render_flake takes no HiveEnv any more, so the memory-cap render test and
render_hive_flake_at, which only existed to vary HiveEnv into the render,
go with it.

Refs #4857

nix/host-modules/hive-c0re/default.nix

@@ -110,9 +110,9 @@ let
     # in whole rather than interpolated — that is also the ONLY thing
     # gc-rooting it: the resulting string carries store context, so this
     # /etc entry genuinely references the package and the host's system
-    # closure holds it alive. Nothing container-side can — meta.rs writes
-    # the path into each agent's generated flake as a plain string
-    # literal, and text is not a reference. Hence the assertion below: do
+    # closure holds it alive. Nothing container-side can: hive-c0re hands
+    # the path to each container as text (`HYPERHIVE_CLAUDE_CODE_PATH`),
+    # and text is not a reference. Hence the assertion below: do
     # NOT discard this context, and do not route the path through
     # anything that drops it. The failure mode is a garbage-collected
     # `claude` and a hive that can't take a turn, weeks after the commit