move the meta flake render into the hive-meta-flake crate

hive-c0re's render_flake and the pieces it needs (AgentSpec, AgentPin,
pinned_git_url, the forwarded-var tables, canonical_inputs_in_lock) move
into a new crate with no IO. The forwarded values and the GitHub switch
are now arguments; hive-c0re passes what it read from its own unit env,
as before. Nothing changes on deploy: the rendered flake is byte-for-byte
the same, and hive-c0re's render tests pass unchanged.

Refs #4857

nix/agent-modules/claude-settings.nix

@@ -72,7 +72,7 @@ in
     internal = true;
     description = ''
       Human-readable swarm name, rendered per-agent by
-      `meta.rs::render_flake` from the host's
+      `hive_meta_flake::render_flake` from the host's
       `services.hyperhive.swarm.name`. Read during evaluation for the
       OTEL `swarm` resource label; `HYPERHIVE_SWARM_NAME` carries the
       same value at runtime.

nix/agent-modules/matrix.nix

@@ -275,7 +275,7 @@ in
     # homeserver is an account the daemon can never log in as, so declaring one
     # unconditionally would enable matrix everywhere and inject a tool surface
     # backed by a permanently no-opping daemon. On a real hive hive-c0re renders
-    # this URL per agent (meta.rs's `FORWARDED_VAR_OPTIONS`), so the common case
+    # this URL per agent (hive-meta-flake's `FORWARDED_VAR_OPTIONS`), so the common case
     # is still "every agent has `main`".
     services.hyperhive.agent.matrixAccounts =
       lib.mkIf (config.services.hyperhive.agent.matrix.url != null)

nix/host-modules/hive-c0re/environment.nix

@@ -256,7 +256,7 @@ in
   lib.optionalAttrs haveBaoClientIdentity {
     BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
     # The same address again under an agent-facing name, forwarded into every
-    # container's module block by `meta::render_flake`. Deliberately not the
+    # container's module block by `hive_meta_flake::render_flake`. Deliberately not the
     # `BAO_ADDR` line itself: a container that inherited this hive's store
     # environment wholesale would inherit the hive's certificate paths with it,
     # and those name a credential no agent may present.