agents: read the hive's name and domain at runtime, not from the build

Part of #5081 (slice S0-1a). An agent's closure no longer depends on the
name or domain of the hive that renders it.

- hive-priv writes /etc/hyperhive-hive-facts (HYPERHIVE_HIVE_NAME,
  HYPERHIVE_HIVE_DOMAIN) into the container from the same WriteNspawnFlags
  call that writes /etc/hyperhive-bridge-dns. hive-c0re passes the values
  from its own unit env. hive-priv refuses a value outside [A-Za-z0-9._-].
- A systemd environment generator in the agent (hive-facts.nix) loads the
  file into the container manager's environment, so every unit sees it,
  as with the systemd.globalEnvironment entries the render used to emit.
  It also builds CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX
  (<hive>-<agent>), which left claude's managed settings.
- meta.rs stops forwarding HYPERHIVE_HIVE_{NAME,DOMAIN} and stops setting
  services.hyperhive.agent.hiveName. The option is removed (both
  spellings now fail with a removal message).
- otel.nix drops the agent's hive= resource label. The swarm collector
  upserts hive per authenticated receiver (swarm-otel.nix resource/<h>,
  on both the metrics and logs pipelines), so stored series keep it.

The otel first hop, otel enable and the dashboard port are still baked;
they are S0-1b.

nix/agent-modules/default.nix

@@ -36,6 +36,11 @@ let
 
     See docs/tools/matrix.md.
   '';
+  hiveNameRemoved = ''
+    An agent reads its hive's name at runtime from /etc/hyperhive-hive-facts,
+    which the hive writes into every container, so no agent build sets it.
+    Remove the setting.
+  '';
 in
 {
   imports = [
@@ -51,6 +56,7 @@ in
     ./frontend.nix
     ./github.nix
     ./github-token.nix
+    ./hive-facts.nix
     ./logs.nix
     ./matrix.nix
     ./mcp.nix
@@ -85,6 +91,9 @@ in
     # breaks evaluation for everyone, removed or not.
     (lib.mkRemovedOptionModule [ "hyperhive" "matrix" "enable" ] matrixEnableRemoved)
     (lib.mkRemovedOptionModule [ "services" "hyperhive" "agent" "matrix" "enable" ] matrixEnableRemoved)
+    # Both spellings, for the reason given above.
+    (lib.mkRemovedOptionModule [ "hyperhive" "hiveName" ] hiveNameRemoved)
+    (lib.mkRemovedOptionModule [ "services" "hyperhive" "agent" "hiveName" ] hiveNameRemoved)
   ];
 
   options.services.hyperhive.agent.icon = lib.mkOption {