hyperhive: make the values the meta-flake render reads swarm-wide

Five host options whose values hive-c0re renders into every agent's
build move under services.hyperhive.swarm, so the swarm states each of
them once instead of every hive carrying its own copy:

  c0re.dashboardPort          -> swarm.dashboardPort
  c0re.claudeCodePackage      -> swarm.claudeCodePackage
  github.enable               -> swarm.github.enable
  otel.collector.port         -> swarm.hiveOtel.collectorPort
  otel.extraResourceAttributes -> swarm.hiveOtel.extraResourceAttributes

Every old path is a mkRenamedOptionModule alias, so a host that sets one
keeps its value and gets an eval warning naming the new path. Types and
defaults are unchanged, so the rendered meta flake, serve.json and
hive-c0re's environment are the same as before on a host that sets
none of them.

The readers move with them: serve.json and its gc-root assertion, the
hive-c0re environment, the hive collector's listen address and bridge
port, the swarm collector's port-collision assertion, and the
claude-login and review-classifier containers' claude pin. The
swarm-services-switch fixture sets the swarm path and now also checks
that serve.json carries the pinned claude.

Part of #4857 (slice 2).

docs/integrations/github.md

@@ -19,17 +19,17 @@ needed — an agent gains GitHub by having a PAT stored for it.
 
 <!-- vale write-good.Passive = YES -->
 
-To turn it off for the whole hive, set the host option:
+To turn it off for the whole swarm, set the swarm option:
 
 ```nix
-services.hyperhive.github.enable = false;
+services.hyperhive.swarm.github.enable = false;
 ```
 
 hive-c0re's meta-flake renderer then injects `services.hyperhive.agent.github.enable = false`
 into every agent, so no agent ships the `gh` wrapper, the credential helper
 or the token fetch.
 (`services.hyperhive.agent.github.enable` also exists per-agent for completeness, but the
-hive-wide host switch is the intended control.)
+swarm-wide switch is the intended control.)
 
 github.com only. The token **value** never touches nix — the agent writes it
 to `<state>/github-token` at runtime (see [Provisioning](#provisioning)).

docs/networking/gateway.md

@@ -129,7 +129,7 @@ The name sits under the swarm domain so authelia's session cookie reaches it, wh
 
 nginx is the one external entry point. The per-agent web-port range (`8100`–`8999`) stays closed: agents serve their UI on a unix socket ([Per-agent unix-socket upstream](#per-agent-unix-socket-upstream)), and the hashed TCP port (`lifecycle::agent_web_port`) is only a fallback bind for an agent missing `HIVE_WEB_SOCKET` — the gateway never proxies through it.
 
-The dashboard port (`services.hyperhive.c0re.dashboardPort`, default 7000) binds `127.0.0.1` only, so remote dashboard access goes through the gateway. The dashboard can stop, rebuild and destroy agents; don't expose it without a reverse proxy in front.
+The dashboard port (`services.hyperhive.swarm.dashboardPort`, default 7000) binds `127.0.0.1` only, so remote dashboard access goes through the gateway. The dashboard can stop, rebuild and destroy agents; don't expose it without a reverse proxy in front.
 
 nginx serves its `stub_status` counters on `127.0.0.1:<statusPort>` (`services.hyperhive.gateway.statusPort`, default 8085) at `/stub_status`, from a server of its own outside the vhost tree. The hive's collector reads them with its `nginx` receiver, and the `gateway` Grafana dashboard plots them. The receiver only dials `http://`, which is why this is loopback TCP rather than a unix socket.
 

docs/process/conventions.md

@@ -11,7 +11,7 @@ exist because something already went wrong without them.
 - `MAX_AGENT_NAME` in `hive-c0re/src/lifecycle/mod.rs` enforces the cap.
 - Per-agent web UI port = `WEB_PORT_BASE + FNV1a(name) % WEB_PORT_RANGE`
   (8100..8999) for every agent; dashboard
-  `services.hyperhive.c0re.dashboardPort` (default 7000).
+  `services.hyperhive.swarm.dashboardPort` (default 7000).
 
 ## Hive identity (label + domain + display names)
 

docs/process/gotchas.md

@@ -140,7 +140,7 @@ _different_ nixpkgs by itself: a container only ever sees the one
 nixpkgs the meta flake injects, so an `agent.nix` naming the host's
 `nixpkgs-unstable` has nothing to name. A release channel can trail
 unstable by weeks on this package, which is what
-`services.hyperhive.c0re.claudeCodePackage` is for — set it host-side
+`services.hyperhive.swarm.claudeCodePackage` is for — set it host-side
 and every agent runs that build.
 
 What crosses is the **store path**, not the derivation. Containers
@@ -228,7 +228,7 @@ agent (different hash → different port) and rebuilding. No state
 file, no probing, no port-allocation drift — the value is
 reproducible from just the name. Every agent hashes into
 8100..8999 via the same FNV-1a; dashboard
-at `services.hyperhive.c0re.dashboardPort` (default 7000).
+at `services.hyperhive.swarm.dashboardPort` (default 7000).
 
 ### Restart races on TCP bind
 

docs/scheduler/observability.md

@@ -179,9 +179,12 @@ To let agents reach some other host-local service of your own →
 The nix module (`nix/host-modules/otel.nix`) generates every
 `services.hyperhive.otel.*` option's full type, default, description and
 example into the [options reference](https://hyperhive.darkest.space/options/)
-(host options — `nix build .#docs-host` for a local render). That's the
-reference; this page covers what a per-option listing can't: the two-tier
-architecture, the security model, and how the options interact.
+(host options — `nix build .#docs-host` for a local render). The values every
+hive and its agents share live in the same module under
+`services.hyperhive.swarm.hiveOtel.*`: the collector port and
+`extraResourceAttributes`, set once for the swarm. That's the reference;
+this page covers what a per-option listing can't: the two-tier architecture,
+the security model, and how the options interact.
 
 ## Built-in resource labels
 

docs/swarm/claude-login.md

@@ -7,8 +7,8 @@ agent's harness installs them from there.
 
 Where it runs and how it's enabled: [`services.md`](services.md#claude-login-minter).
 
-The service runs the `claude-code` that `services.hyperhive.c0re.claudeCodePackage`
-pins for agents, and its container's own nixpkgs' where the hive pins none.
+The service runs the `claude-code` that `services.hyperhive.swarm.claudeCodePackage`
+pins for agents, and its container's own nixpkgs' where the swarm pins none.
 
 ## What happens on a login
 

docs/swarm/review-classifier.md

@@ -145,8 +145,8 @@ config) and an empty directory of its own. The prompt reaches it on stdin as
 one user message in `--input-format stream-json`, so that it can carry content
 blocks (see [Shared context](#shared-context)).
 
-The `claude` is the one `services.hyperhive.c0re.claudeCodePackage` pins for
-agents, or its container's own nixpkgs' where the hive pins none.
+The `claude` is the one `services.hyperhive.swarm.claudeCodePackage` pins for
+agents, or its container's own nixpkgs' where the swarm pins none.
 
 On the ACP runtime, each classification is one prompt on a new `opencode acp`
 session. Its config and opencode's state live in a directory of its own,

docs/turn-loop/claude-invocation.md

@@ -32,8 +32,8 @@ to the bus.
 harness unit's PATH. By default that's the `claude-code` in the agent's
 own nixpkgs (the meta flake's `nixpkgs` input) via
 `environment.systemPackages`. Since that's typically a release channel and
-this package moves fast, the operator can pin one hive-wide with
-`services.hyperhive.c0re.claudeCodePackage`: hive-c0re writes its
+this package moves fast, the operator can pin one swarm-wide with
+`services.hyperhive.swarm.claudeCodePackage`: hive-c0re writes its
 store path into each agent's flake, and `claude` on PATH becomes a symlink to it
 instead of the container's own `claude-code` — so there's only ever one
 `claude` in the container. Agents pick up a new build on their