move the meta flake render into the hive-meta-flake crate

hive-c0re's render_flake and the pieces it needs (AgentSpec, AgentPin,
pinned_git_url, the forwarded-var tables, canonical_inputs_in_lock) move
into a new crate with no IO. The forwarded values and the GitHub switch
are now arguments; hive-c0re passes what it read from its own unit env,
as before. Nothing changes on deploy: the rendered flake is byte-for-byte
the same, and hive-c0re's render tests pass unchanged.

Refs #4857

Cargo.lock

@@ -1781,6 +1781,7 @@ dependencies = [
  "hive-jobq",
  "hive-jobq-wire",
  "hive-log",
+ "hive-meta-flake",
  "hive-priv-sock",
  "hive-sh4re",
  "hive-sock-client",
@@ -1959,6 +1960,15 @@ dependencies = [
  "tracing-subscriber",
 ]
 
+[[package]]
+name = "hive-meta-flake"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "serde_json",
+ "swarm-wire",
+]
+
 [[package]]
 name = "hive-metric"
 version = "0.1.0"