agents: read the hive's name and domain at runtime, not from the build

Part of #5081 (slice S0-1a). An agent's closure no longer depends on the
name or domain of the hive that renders it.

- hive-priv writes /etc/hyperhive-hive-facts (HYPERHIVE_HIVE_NAME,
  HYPERHIVE_HIVE_DOMAIN) into the container from the same WriteNspawnFlags
  call that writes /etc/hyperhive-bridge-dns. hive-c0re passes the values
  from its own unit env. hive-priv refuses a value outside [A-Za-z0-9._-].
- A systemd environment generator in the agent (hive-facts.nix) loads the
  file into the container manager's environment, so every unit sees it,
  as with the systemd.globalEnvironment entries the render used to emit.
  It also builds CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX
  (<hive>-<agent>), which left claude's managed settings.
- meta.rs stops forwarding HYPERHIVE_HIVE_{NAME,DOMAIN} and stops setting
  services.hyperhive.agent.hiveName. The option is removed (both
  spellings now fail with a removal message).
- otel.nix drops the agent's hive= resource label. The swarm collector
  upserts hive per authenticated receiver (swarm-otel.nix resource/<h>,
  on both the metrics and logs pipelines), so stored series keep it.

The otel first hop, otel enable and the dashboard port are still baked;
they are S0-1b.

docs/scheduler/observability.md

@@ -193,9 +193,12 @@ automatically:
 | -------------- | ------------------------------------------------------------ |
 | `service.name` | `hyperhive-agent` (constant)                                 |
 | `agent`        | agent logical name (for example `iris`)                      |
-| `hive`         | hive display name (`services.hyperhive.hiveName`)            |
 | `swarm`        | swarm display name (`services.hyperhive.swarm.name`, if set) |
 
+The swarm's collector adds `hive`, the name of the hive whose receiver accepted
+the push (see [Authenticated ingest](#authenticated-ingest)). The container
+doesn't set it.
+
 Append additional labels via `extraResourceAttributes` (see option
 reference above); pass custom per-data-point labels with
 `hive-metric --labels` (see below).
@@ -368,10 +371,10 @@ API-reported window, else the model's default. A turn that parsed no usage
 leaves both where the previous turn put them. The dashboard's **Context
 window used by agent** panel (health tab) divides one by the other.
 
-Resource attributes (`service.name`, `agent`, `hive`, `swarm`) come from the
+Resource attributes (`service.name`, `agent`, `swarm`) come from the
 same container-wide `OTEL_RESOURCE_ATTRIBUTES` as everything else in this
-section — nothing extra to configure. Cadence follows
-`HYPERHIVE_OTEL_METRIC_INTERVAL_MS` (default 60s, same variable + default as
+section, and the swarm's collector adds `hive` — nothing extra to configure.
+Cadence follows `HYPERHIVE_OTEL_METRIC_INTERVAL_MS` (default 60s, same variable + default as
 `hive-c0re`'s container-resource export above) — that only controls how often
 the harness flushes the batched points to the collector, not how often it
 records them (every turn, always).
@@ -479,7 +482,7 @@ hive-metric <name> <value> [--type counter|gauge] [--temporality delta|cumulativ
   itself).
 - `--labels key=value` — extra per-data-point labels. Repeat the flag for
   more than one.
-  `hive-metric` inherits the resource labels (agent, hive, swarm, service.name)
+  `hive-metric` inherits the resource labels (agent, swarm, service.name)
   automatically from `OTEL_RESOURCE_ATTRIBUTES` — don't re-specify them.
 
 ### Examples