feat: per-agent CPU and memory limits

The hive applies one `agentCpuQuota` / `agentMemoryMax` to every
container. That's the right default and the wrong ceiling: a build-heavy
agent needs headroom the other twelve don't, and raising the hive-wide
value to suit it hands that headroom to everyone.

Adds a per-agent override, persisted host-side and resolved per-field
against the hive defaults.

Follows the existing `meta/*.json` pattern (`capabilities.json`,
`tool-groups.json`): a host-side map read by `hive-c0re`, staged and
committed in the meta repo so every change lands in the audit trail.

```json
{ "sock": { "cpu_quota": "400%", "memory_max": "8G" } }
```

Fallback is **per field**, not per agent: an entry with only
`memory_max` leaves that agent on the hive-wide CPU quota. Absent file,
absent agent and absent field all resolve to the hive default, so the
feature is inert until someone opts an agent in.

Unlike the other meta files this one is **not** injected into the
container — a limit is something done *to* an agent, not something it
reads about itself.

```
hivectl agents set-limits sock --cpu-quota 400% --memory-max 8G
hivectl agents set-limits sock --reset
```

Values are validated before they're persisted: they go into a systemd
drop-in verbatim, and a typo there makes the unit fail to *start* —
turning a fat-fingered quota into a container that won't come back.

The command is declarative: each call replaces the agent's whole entry.
That makes a forgotten flag a silent revert, so a bare `set-limits
<name>` is rejected at the clap layer and clearing needs an explicit
`--reset`.

`ContainerView` gains `cpu_quota` / `memory_max`, both always populated:
there's no "unset" state to render, only "same as everyone else". They
reflect what the drop-in *says* — what the next start will enforce — not
a live cgroup reading.

The write goes through `meta::commit_resource_limits` rather than the
bare setter, so it's staged and committed under `META_LOCK`. Writing
without committing would leave the meta working tree dirty for the next
`prepare_deploy` to trip over.

Docs: `persistence.md` (the new meta file, and why it isn't injected),
`tools/hivectl.md` (the prose guide), `tools/hivectl-cli.md`
(regenerated clap dump).

Closes: internal/requests issue 25

hive-c0re/src/container_view.rs

@@ -62,11 +62,26 @@ pub struct ContainerView {
     /// a legitimate way to keep it idle when it next boots.
     #[serde(default)]
     pub paused: bool,
+    /// Effective systemd `CPUQuota=` for this container (e.g. `"400%"`) —
+    /// the per-agent override from `meta/resource-limits.json` when set,
+    /// otherwise the hive-wide `agentCpuQuota`. Always populated: there
+    /// is no "unset" state to render, only "same as everyone else".
+    /// Reflects what the *drop-in says*, which is what the next start
+    /// will enforce — not a live cgroup reading.
+    pub cpu_quota: String,
+    /// Effective systemd `MemoryMax=` for this container (e.g. `"8G"`).
+    /// Same resolution + caveat as [`ContainerView::cpu_quota`].
+    pub memory_max: String,
 }
 
 /// Build the full container list. Wraps `lifecycle::list()` and
 /// resolves every per-agent attribute the dashboard surfaces.
-pub async fn build_all() -> Vec<ContainerView> {
+///
+/// Takes `hive` because the effective resource limits are a per-field
+/// fallback onto the hive-wide `agent_cpu_quota` / `agent_memory_max`,
+/// and those live on [`HiveEnv`], not on disk. Both callers already
+/// hold a `Coordinator`, so this is a parameter rather than a global.
+pub async fn build_all(hive: &crate::coordinator::HiveEnv) -> Vec<ContainerView> {
     let raw = lifecycle::list().await.unwrap_or_default();
     let locked = read_meta_locked_revs();
     // Pull the topology map once and look up each agent's parent below.
@@ -108,6 +123,11 @@ pub async fn build_all() -> Vec<ContainerView> {
             None
         };
         let paused = Coordinator::is_paused(&logical);
+        let (cpu_quota, memory_max) = crate::resource_limits::effective(
+            logical.as_str(),
+            &hive.agent_cpu_quota,
+            &hive.agent_memory_max,
+        );
         out.push(ContainerView {
             port: lifecycle::agent_web_port(logical.as_str()),
             running,
@@ -119,6 +139,8 @@ pub async fn build_all() -> Vec<ContainerView> {
             parent,
             active_model,
             paused,
+            cpu_quota,
+            memory_max,
         });
     }
     out