fix(#2172): gate CLAUDE_CODE_OTEL_DIAG_STDERR on hyperhive.otel.debug

CLAUDE_CODE_OTEL_DIAG_STDERR was always set when OTEL is enabled, making
OTEL SDK errors (e.g. 404 from a misconfigured collector endpoint) appear
in every agent's stderr unconditionally. Move it behind a new opt-in flag.

Changes:
- nix/modules/hive-c0re.nix: add services.hyperhive.otel.debug (bool,
  default false); wire to HYPERHIVE_OTEL_DEBUG env on hive-c0re unit.
- hive-c0re/src/meta.rs: add debug field to OtelConfig; read
  HYPERHIVE_OTEL_DEBUG; emit hyperhive.otel.debug = true when set.
- nix/templates/harness-base.nix: add hyperhive.otel.debug internal
  option; move CLAUDE_CODE_OTEL_DIAG_STDERR out of otelSettingsEnv into
  a debug-gated lib.optionalAttrs block.

Default behaviour: OTEL exports silently (no stderr noise). Operators
troubleshooting collector connectivity set services.hyperhive.otel.debug
= true to re-enable the diagnostic output.

nix/modules/hive-c0re.nix

@@ -279,6 +279,18 @@ in
       '';
     };
 
+    debug = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Emit OTEL SDK diagnostic messages to every agent's stderr by
+        setting `CLAUDE_CODE_OTEL_DIAG_STDERR=1`. Useful when
+        troubleshooting collector connectivity or endpoint config;
+        leave off in normal operation to avoid noise in agent logs.
+        Only meaningful when `enable` is true.
+      '';
+    };
+
     metricIntervalMs = lib.mkOption {
       type = lib.types.nullOr lib.types.ints.positive;
       default = null;
@@ -923,6 +935,9 @@ in
         // lib.optionalAttrs (otel.metricIntervalMs != null) {
           HYPERHIVE_OTEL_METRIC_INTERVAL_MS = toString otel.metricIntervalMs;
         }
+        // lib.optionalAttrs otel.debug {
+          HYPERHIVE_OTEL_DEBUG = "1";
+        }
       )
       // {
         # In-cluster forge URL — the gateway vhost (`forge.<domain>`), which