agents: read the hive's name and domain at runtime, not from the build

Part of #5081 (slice S0-1a). An agent's closure no longer depends on the
name or domain of the hive that renders it.

- hive-priv writes /etc/hyperhive-hive-facts (HYPERHIVE_HIVE_NAME,
  HYPERHIVE_HIVE_DOMAIN) into the container from the same WriteNspawnFlags
  call that writes /etc/hyperhive-bridge-dns. hive-c0re passes the values
  from its own unit env. hive-priv refuses a value outside [A-Za-z0-9._-].
- A systemd environment generator in the agent (hive-facts.nix) loads the
  file into the container manager's environment, so every unit sees it,
  as with the systemd.globalEnvironment entries the render used to emit.
  It also builds CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX
  (<hive>-<agent>), which left claude's managed settings.
- meta.rs stops forwarding HYPERHIVE_HIVE_{NAME,DOMAIN} and stops setting
  services.hyperhive.agent.hiveName. The option is removed (both
  spellings now fail with a removal message).
- otel.nix drops the agent's hive= resource label. The swarm collector
  upserts hive per authenticated receiver (swarm-otel.nix resource/<h>,
  on both the metrics and logs pipelines), so stored series keep it.

The otel first hop, otel enable and the dashboard port are still baked;
they are S0-1b.

nix/agent-modules/claude-settings.nix

@@ -19,17 +19,6 @@ let
   # meta.rs `otel_config`). Options declared in `otel.nix`, which also
   # exports the generic OTLP environment this container's producers read.
   otelCfg = config.services.hyperhive.agent.otel;
-  # Hive display name, read from the per-agent option meta.rs renders
-  # (NOT from `environment.variables` — that carries the same name at
-  # *runtime* only, so reading it here silently yielded "unknown" on
-  # every agent while the process env held the right answer). `null`
-  # means the hive did not name itself; "unknown" is then an honest label
-  # rather than a guess.
-  hiveDisplayName =
-    if config.services.hyperhive.agent.hiveName == null then
-      "unknown"
-    else
-      config.services.hyperhive.agent.hiveName;
   # Effective per-agent MemoryMax=, in bytes, injected by meta.rs's
   # per-agent flake render (`services.hyperhive.agent.claudeMemoryMaxBytes`). `null`
   # when the effective cap is unbounded ("infinity") or a RAM
@@ -58,8 +47,6 @@ let
     CLAUDE_CODE_RESUME_INTERRUPTED_TURN = "1";
     # Use the simpler system prompt variant suited to headless operation.
     CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT = "1";
-    # Tag remote-control sessions with "<hive>-<agent>" for identification.
-    CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX = "${hiveDisplayName}-${userName}";
   }
   # Bun/JavaScriptCore (the runtime under claude-code's `.claude-wrapped`
   # binary) sizes its default heap ceiling off the container's visible
@@ -97,6 +84,21 @@ let
   };
 in
 {
+  options.services.hyperhive.agent.swarmName = lib.mkOption {
+    type = lib.types.nullOr lib.types.str;
+    default = null;
+    internal = true;
+    description = ''
+      Human-readable swarm name, rendered per-agent by
+      `meta.rs::render_flake` from the host's
+      `services.hyperhive.swarm.name`. Read during evaluation for the
+      OTEL `swarm` resource label; `HYPERHIVE_SWARM_NAME` carries the
+      same value at runtime.
+
+      `null` means the hive is not part of a named swarm.
+    '';
+  };
+
   # Build-time implementation surface for the JSC-heap-ceiling fix:
   # meta.rs's per-agent flake render injects this from the effective
   # `MemoryMax=` (per-agent `resource-limits.json` override, else the
@@ -108,37 +110,6 @@ in
   # the agent's *last rebuild* — `set-limits` still applies the
   # cgroup cap live via a drop-in reload, but this derived heap ceiling
   # needs a rebuild to pick up a new value.
-  options.services.hyperhive.agent.hiveName = lib.mkOption {
-    type = lib.types.nullOr lib.types.str;
-    default = null;
-    internal = true;
-    description = ''
-      Human-readable hive name, rendered per-agent by
-      `meta.rs::render_flake` from the host's
-      `services.hyperhive.hiveName`. Baked into the OTEL resource
-      attributes at build time, which is why it is an option and not
-      just the `HYPERHIVE_HIVE_NAME` env var: the env var is read at
-      runtime, this is read during evaluation, and wiring only one of
-      the two is how every agent ended up reporting `hive=unknown`.
-
-      `null` means the hive did not name itself.
-    '';
-  };
-
-  options.services.hyperhive.agent.swarmName = lib.mkOption {
-    type = lib.types.nullOr lib.types.str;
-    default = null;
-    internal = true;
-    description = ''
-      Human-readable swarm name, rendered per-agent by
-      `meta.rs::render_flake` from the host's
-      `services.hyperhive.swarm.name`. Same build-time/runtime split as
-      `services.hyperhive.agent.hiveName`.
-
-      `null` means the hive is not part of a named swarm.
-    '';
-  };
-
   options.services.hyperhive.agent.claudeMemoryMaxBytes = lib.mkOption {
     type = lib.types.nullOr lib.types.ints.positive;
     default = null;
@@ -279,7 +250,7 @@ in
     # Hive-enforced settings merged with a per-agent `env` block at BUILD
     # time via `jq` (not eval-time `readFile`, which would be import-from-
     # derivation). The `env` block is always present: `baseClaudeEnv` sets
-    # behaviour flags and the remote-control session prefix for every agent;
+    # behaviour flags for every agent;
     # `otelSettingsEnv` is merged on top when OTEL is enabled. claude-code
     # auto-discovers this file in every context (harness turn-loop AND
     # `hivectl choom`) so no launch wrapper is needed.
@@ -287,9 +258,8 @@ in
       let
         baseSettings = "${config.services.hyperhive.agent.packages.assets}/share/hyperhive/prompts/claude-settings.json";
         # Merge base env (always) with OTEL env (when enabled). jq is always
-        # run — `baseClaudeEnv` contains per-agent values (e.g.
-        # CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX) that can't live in the
-        # static store asset.
+        # run — `baseClaudeEnv` can carry per-agent values (e.g.
+        # BUN_JSC_forceRAMSize) that can't live in the static store asset.
         allEnv =
           baseClaudeEnv
           // lib.optionalAttrs otelCfg.enable otelSettingsEnv