hand agents the queue address at container start

HIVE_AGENT_NATS_URL now reaches each container in its hive facts, from
the host's deploy.hive-controller.queue.agentNatsUrl, instead of being
rendered into the meta flake. The agent option
services.hyperhive.agent.queue.natsUrl is removed; the harness unit
imports the queue credential whenever the token endpoint is set.

On deploy every agent rebuilds once (the rendered flake loses the
address), and the harness reads the address from the facts file
hive-priv writes before each start.

Refs #4857

hive-priv-sock/src/lib.rs

@@ -196,6 +196,9 @@ pub struct HiveFacts {
     /// `HYPERHIVE_OTEL_EXTRA_RESOURCE_ATTRIBUTES`: comma-separated `k=v`
     /// entries the agent appends to its `OTEL_RESOURCE_ATTRIBUTES`.
     pub otel_extra_resource_attributes: Option<String>,
+    /// `HIVE_AGENT_NATS_URL`: where the agent reaches the swarm queue, from
+    /// `deploy.hive-controller.queue.agentNatsUrl`.
+    pub agent_nats_url: Option<String>,
 }
 
 /// Wall-clock bound hive-priv puts on one [`PrivRequest::MeasureAgentDisk`]