hand agents the dashboard port, pinned claude and otel labels at container start

The three values that differ per host (deploy.hive-controller.dashboardPort,
claudeCodePackage and otel.extraResourceAttributes) no longer go into the
meta flake. hive-priv writes them into the container's
/etc/hyperhive-hive-facts with the hive name and domain, and the agent
reads them at boot:

- HIVE_DASHBOARD_PORT reaches every unit through the hive-facts generator;
  the web UI still defaults to 7000 without it.
- `claude` on PATH is a wrapper that runs HYPERHIVE_CLAUDE_CODE_PATH's
  claude when it is there, and the container's own claude-code otherwise.
  The host's serve.json keeps gc-rooting the pinned build.
- OTEL_RESOURCE_ATTRIBUTES moves out of the units' Environment= into a
  boot-time generator, which appends HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES.

The agent options services.hyperhive.agent.claudeCodePath (now a removed
option) and otel.extraResourceAttributes go; only the meta render set them.
render_flake takes no HiveEnv any more, so the memory-cap render test and
render_hive_flake_at, which only existed to vary HiveEnv into the render,
go with it.

Refs #4857

nix/module-eval/agent-otel.nix

@@ -123,6 +123,25 @@ let
         && lib.all (e: s.exporters.${e}.endpoint == endpoint) s.service.pipelines.logs.exporters
         && !(agentNoOtel.systemd.globalEnvironment ? OTEL_EXPORTER_OTLP_ENDPOINT);
     }
+    {
+      # The hive's extra labels arrive at container start, so the build
+      # cannot hold the whole `OTEL_RESOURCE_ATTRIBUTES`: a boot-time
+      # generator computes it, and a unit-level `Environment=` copy would
+      # override that. The endpoint beside it is the presence control for the
+      # two absence lookups; `agentNoOtel` is the control for the generator.
+      name = "an agent's OTEL resource labels come from a boot-time generator, not the build";
+      ok =
+        let
+          generator =
+            m: m.environment.etc ? "systemd/system-environment-generators/60-hyperhive-otel-resource";
+        in
+        agentDefault.systemd.globalEnvironment ? OTEL_EXPORTER_OTLP_ENDPOINT
+        && !(agentDefault.systemd.globalEnvironment ? OTEL_RESOURCE_ATTRIBUTES)
+        && agentDefault.environment.variables ? OTEL_EXPORTER_OTLP_ENDPOINT
+        && !(agentDefault.environment.variables ? OTEL_RESOURCE_ATTRIBUTES)
+        && generator agentDefault
+        && !(generator agentNoOtel);
+    }
     {
       # Presence control for the two cases above: with the switch off there
       # is no collector in the container at all, so their passing is about

nix/module-eval/swarm-services-switch.nix

@@ -282,7 +282,7 @@ let
     {
       # The CLI is the one the agents run, not the container's own nixpkgs'.
       # Unpinned is the control: it falls back to the container's own `claude-code`.
-      # serve.json is what hive-c0re renders every agent's `claudeCodePath` from.
+      # serve.json is what hive-c0re hands every agent's `HYPERHIVE_CLAUDE_CODE_PATH` from.
       name = "the agents, the claude login minter and the review classifier run the claude-code this host pins";
       ok =
         let