feat(#2899): add host.arch + service.version to container metrics

The container-resource exporter identified the samples it sent by
container and by hive, but not by machine or by build — so a sample
could not be attributed to the host it came from or the deploy that
produced it.

Both go on the OTEL resource rather than on each data point, for the
same reason `hive` / `swarm` already do: they are constant across one
hive-c0re. Only per-container facts stay per-data-point.

- `host.arch` — mapped to the semconv spelling, not forwarded from
  rust's. The two disagree on exactly the architectures this runs on
  (`x86_64` / `aarch64` vs `amd64` / `arm64`), and the failure mode is
  silent: a dashboard filtering the standard value matches nothing.
  A test pins this, since nothing else would catch it.
- `service.version` — the running flake rev, via
  `auto_update::current_flake_rev`, the same source the dashboard
  snapshot and `get_agent_meta` already use. NOT the crate version:
  that's a workspace constant that never moves between deploys, so it
  could not answer "which build produced this sample?". Omitted rather
  than guessed when the flake ref carries no rev.

`spawn_exporter` takes the flake ref to reach the rev — the string it
needs, not the whole `Coordinator`, so the module's coupling doesn't
widen for one attribute.

The issue's third item, `container`, needs no change: `attrs()` has
emitted `container.name` per data point since this exporter landed.

Checked with clippy (`--all-targets -D warnings`), `cargo test -p
hive-c0re` (321 passed) and `nix fmt`. No option surface is touched, so
no nix-eval gate.

hive-c0re/src/main.rs

@@ -519,7 +519,7 @@ async fn cmd_serve(
     // cgroup gauges out to the configured OTLP endpoint, reusing the hive
     // `services.hyperhive.otel` config (endpoint + LoadCredential auth).
     // No-op when OTEL isn't configured.
-    crate::otel_metrics::spawn_exporter();
+    crate::otel_metrics::spawn_exporter(&coord.hyperhive_flake);
     // build_logs.sqlite vacuum: c0re-side (single db). Failures kept
     // 30d, successes 24h — see `build_logs::vacuum` for the rule.
     crate::build_logs::spawn_vacuum(&coord);