hyperhive: make the values the meta-flake render reads swarm-wide

Five host options whose values hive-c0re renders into every agent's
build move under services.hyperhive.swarm, so the swarm states each of
them once instead of every hive carrying its own copy:

  c0re.dashboardPort          -> swarm.dashboardPort
  c0re.claudeCodePackage      -> swarm.claudeCodePackage
  github.enable               -> swarm.github.enable
  otel.collector.port         -> swarm.hiveOtel.collectorPort
  otel.extraResourceAttributes -> swarm.hiveOtel.extraResourceAttributes

Every old path is a mkRenamedOptionModule alias, so a host that sets one
keeps its value and gets an eval warning naming the new path. Types and
defaults are unchanged, so the rendered meta flake, serve.json and
hive-c0re's environment are the same as before on a host that sets
none of them.

The readers move with them: serve.json and its gc-root assertion, the
hive-c0re environment, the hive collector's listen address and bridge
port, the swarm collector's port-collision assertion, and the
claude-login and review-classifier containers' claude pin. The
swarm-services-switch fixture sets the swarm path and now also checks
that serve.json carries the pinned claude.

Part of #4857 (slice 2).

nix/agent-modules/default.nix

@@ -96,7 +96,7 @@ in
       nixpkgs.
 
       Set by the generated meta flake when the operator sets
-      `services.hyperhive.c0re.claudeCodePackage` host-side, so a hive
+      `services.hyperhive.swarm.claudeCodePackage` host-side, so a swarm
       can run a claude built from a *different* nixpkgs than the one
       its agents evaluate against — a release channel can trail
       unstable by weeks on this one package. It arrives as a path and
@@ -109,7 +109,7 @@ in
       there is only ever one claude in the container. Note that neither
       the symlink nor anything else in the container's closure *refers*
       to the target — keeping it alive is the host's job, see
-      `services.hyperhive.c0re.claudeCodePackage`.
+      `services.hyperhive.swarm.claudeCodePackage`.
     '';
   };
 
@@ -255,7 +255,7 @@ in
           # The symlink registers no store reference — the target isn't
           # among this derivation's inputs, so nothing here keeps the
           # binary alive. That is deliberate and it is the host's job:
-          # see `services.hyperhive.c0re.claudeCodePackage`.
+          # see `services.hyperhive.swarm.claudeCodePackage`.
           pkgs.runCommandLocal "claude-code-pinned" { } ''
             mkdir -p "$out/bin"
             ln -s ${config.services.hyperhive.agent.claudeCodePath}/bin/claude "$out/bin/claude"

nix/agent-modules/github.nix

@@ -55,8 +55,8 @@ in
       a compromised agent can act within the token's scopes --- scope is the
       real blast-radius limiter.
 
-      On by default. Host-driven: set `services.hyperhive.github.enable = false`
-      to turn the integration off hive-wide (meta.rs propagates the override
+      On by default. Host-driven: set `services.hyperhive.swarm.github.enable = false`
+      to turn the integration off swarm-wide (meta.rs propagates the override
       into every agent).
     '';
   };

nix/agent-modules/otel.nix

@@ -125,7 +125,7 @@ in
         Extra comma-separated entries appended to
         `OTEL_RESOURCE_ATTRIBUTES` after the built-in
         `service.name` / `agent` / `swarm` labels.
-        Host-driven via `services.hyperhive.otel.extraResourceAttributes`.
+        Host-driven via `services.hyperhive.swarm.hiveOtel.extraResourceAttributes`.
       '';
     };