agents: read the hive's name and domain at runtime, not from the build

Part of #5081 (slice S0-1a). An agent's closure no longer depends on the
name or domain of the hive that renders it.

- hive-priv writes /etc/hyperhive-hive-facts (HYPERHIVE_HIVE_NAME,
  HYPERHIVE_HIVE_DOMAIN) into the container from the same WriteNspawnFlags
  call that writes /etc/hyperhive-bridge-dns. hive-c0re passes the values
  from its own unit env. hive-priv refuses a value outside [A-Za-z0-9._-].
- A systemd environment generator in the agent (hive-facts.nix) loads the
  file into the container manager's environment, so every unit sees it,
  as with the systemd.globalEnvironment entries the render used to emit.
  It also builds CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX
  (<hive>-<agent>), which left claude's managed settings.
- meta.rs stops forwarding HYPERHIVE_HIVE_{NAME,DOMAIN} and stops setting
  services.hyperhive.agent.hiveName. The option is removed (both
  spellings now fail with a removal message).
- otel.nix drops the agent's hive= resource label. The swarm collector
  upserts hive per authenticated receiver (swarm-otel.nix resource/<h>,
  on both the metrics and logs pipelines), so stored series keep it.

The otel first hop, otel enable and the dashboard port are still baked;
they are S0-1b.

nix/agent-modules/hive-facts.nix

@@ -0,0 +1,37 @@
+# The hive this container runs on, read at boot rather than built in, so an
+# agent's closure does not carry it.
+#
+# hive-priv writes `/etc/hyperhive-hive-facts` into the container before every
+# start (`HYPERHIVE_HIVE_NAME`, `HYPERHIVE_HIVE_DOMAIN`, one `KEY=value` line
+# each). This environment generator hands those lines to the container's
+# systemd, which passes them to every unit it starts and to `machinectl shell`
+# sessions; a unit's own `Environment=` still overrides them.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  userName = config.services.hyperhive.agent.user.name;
+in
+{
+  # Shell builtins only: nothing is assumed on PATH this early. Only the two
+  # known keys are passed on.
+  environment.etc."systemd/system-environment-generators/50-hyperhive-hive-facts".source =
+    pkgs.writeShellScript "hyperhive-hive-facts" ''
+      hive=unknown
+      if [ -r /etc/hyperhive-hive-facts ]; then
+        while IFS='=' read -r key value; do
+          case "$key" in
+            HYPERHIVE_HIVE_NAME) hive=$value ;;
+            HYPERHIVE_HIVE_DOMAIN) ;;
+            *) continue ;;
+          esac
+          printf '%s=%s\n' "$key" "$value"
+        done < /etc/hyperhive-hive-facts
+      fi
+      # Names claude's remote-control sessions `<hive>-<agent>`.
+      printf 'CLAUDE_REMOTE_CONTROL_SESSION_NAME_PREFIX=%s-%s\n' "$hive" ${lib.escapeShellArg userName}
+    '';
+}