agents: read the hive's name and domain at runtime, not from the build

Part of #5081 (slice S0-1a). An agent's closure no longer depends on the
name or domain of the hive that renders it.

- hive-priv writes /etc/hyperhive-hive-facts (HYPERHIVE_HIVE_NAME,
  HYPERHIVE_HIVE_DOMAIN) into the container from the same WriteNspawnFlags
  call that writes /etc/hyperhive-bridge-dns. hive-c0re passes the values
  from its own unit env. hive-priv refuses a value outside [A-Za-z0-9._-].
- A systemd environment generator in the agent (hive-facts.nix) loads the
  file into the container manager's environment, so every unit sees it,
  as with the systemd.globalEnvironment entries the render used to emit.
  It also builds CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX
  (<hive>-<agent>), which left claude's managed settings.
- meta.rs stops forwarding HYPERHIVE_HIVE_{NAME,DOMAIN} and stops setting
  services.hyperhive.agent.hiveName. The option is removed (both
  spellings now fail with a removal message).
- otel.nix drops the agent's hive= resource label. The swarm collector
  upserts hive per authenticated receiver (swarm-otel.nix resource/<h>,
  on both the metrics and logs pipelines), so stored series keep it.

The otel first hop, otel enable and the dashboard port are still baked;
they are S0-1b.

hive-priv-sock/src/lib.rs

@@ -232,6 +232,18 @@ pub struct NetworkIsolation {
     pub gateway_ip: String,
 }
 
+/// Facts about the hive a container runs on, for `WriteNspawnFlags`.
+/// hive-priv writes them into the container's `/etc/hyperhive-hive-facts`,
+/// which the agent loads into its environment at boot, so no agent build
+/// carries them. A `None` field leaves that variable unset in the agent.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct HiveFacts {
+    /// `HYPERHIVE_HIVE_NAME`: the hive's name (`pr1ma`).
+    pub name: Option<String>,
+    /// `HYPERHIVE_HIVE_DOMAIN`: the hive's DNS domain.
+    pub domain: Option<String>,
+}
+
 /// Wall-clock bound hive-priv puts on one [`PrivRequest::MeasureAgentDisk`]
 /// walk. A caller's own wait has to be longer than this, so a slow walk
 /// reaches it as hive-priv's timeout error rather than as its own.
@@ -306,6 +318,10 @@ pub enum PrivRequest {
         /// so a hive-priv built before this field deserialises new requests.
         #[serde(default)]
         load_credentials: Vec<CredentialMount>,
+        /// Written to the container's `/etc/hyperhive-hive-facts` on every
+        /// call, so a fact the hive no longer has is removed, not kept.
+        #[serde(default)]
+        hive_facts: HiveFacts,
     },
 
     /// Create the agent's socket dir `/run/hive-agent/<name>` as `0751