feat(#2754): hive-wide CPUWeight= / IOWeight= for agent containers

`CPUQuota=`/`MemoryMax=` are hard caps: they throttle an agent even when
the host is idle, so they are the wrong tool for "be polite under
contention". The cgroup v2 relative shares are, and neither was wired.

Adds `services.hyperhive.{agentCpuWeight,agentIoWeight}` (1..=10000,
default 80) threaded through the existing drop-in path: HiveEnv ->
write_dropins -> WriteResourceLimits -> hyperhive-limits.conf, next to
the caps already there. Hive-wide only, as the operator scoped it on the
issue: no per-agent override, no resource-limits.json field, no
dashboard form.

The default of 80 is below the kernel's 100, so agent containers yield
to everything *not* on this drop-in path -- host services and the infra
containers (hive-ci, hive-forge, hive-gateway, hive-matrix). It does not
rank agents against each other; they all carry the same weight.

`WriteResourceLimits` gains two `#[serde(default)]` fields, and the
writer treats weight 0 as "not configured" and omits the line, so an
older hive-c0re talking to a newer hive-priv still produces the exact
pre-weights drop-in. The body is extracted into `limits_dropin_body` so
that is covered by a test rather than asserted by eye.

hive-c0re/src/lifecycle/host_config.rs

@@ -25,7 +25,14 @@ pub async fn write_dropins(name: &str, hive: &HiveEnv, paths: &AgentPaths) -> Re
     set_nspawn_flags(&container, &paths.agent, &paths.claude, &paths.notes).await?;
     let (cpu_quota, memory_max) =
         crate::resource_limits::effective(name, &hive.agent_cpu_quota, &hive.agent_memory_max);
-    set_resource_limits(&container, &cpu_quota, &memory_max).await?;
+    set_resource_limits(
+        &container,
+        &cpu_quota,
+        &memory_max,
+        hive.agent_cpu_weight,
+        hive.agent_io_weight,
+    )
+    .await?;
     systemd_daemon_reload().await
 }
 
@@ -34,8 +41,21 @@ pub async fn write_dropins(name: &str, hive: &HiveEnv, paths: &AgentPaths) -> Re
 /// `meta/resource-limits.json` where set, the hive-wide defaults
 /// otherwise. Goes under `/run/systemd/system/...` so it's ephemeral
 /// (regenerated on every spawn / rebuild).
-async fn set_resource_limits(container: &str, cpu_quota: &str, memory_max: &str) -> Result<()> {
-    crate::priv_client::write_resource_limits(container, memory_max, cpu_quota).await
+///
+/// The weights are hive-wide (`services.hyperhive.agentCpuWeight` /
+/// `agentIoWeight`) — unlike the caps they have no per-agent override in
+/// `meta/resource-limits.json`, so they come straight off [`HiveEnv`].
+async fn set_resource_limits(
+    container: &str,
+    cpu_quota: &str,
+    memory_max: &str,
+    cpu_weight: u32,
+    io_weight: u32,
+) -> Result<()> {
+    crate::priv_client::write_resource_limits(
+        container, memory_max, cpu_quota, cpu_weight, io_weight,
+    )
+    .await
 }
 
 async fn systemd_daemon_reload() -> Result<()> {