remove the swarm wireguard mesh; tombstone its options

nix/agent-modules/default.nix

@@ -267,8 +267,7 @@ in
     # nix/packages/default.nix + ./packages.nix) rather than the full
     # `hyperhive` bundle — that bundle also carries `hivectl` (a
     # host-admin CLI that dials the *host* admin socket — useless and
-    # unreachable from inside a container — wrapped with
-    # `wireguard-tools` for `hivectl wg`). The daemon/harness/MCP bins
+    # unreachable from inside a container). The daemon/harness/MCP bins
     # the harness execs (hive-agent{,-mcp}, hive-bash-daemon,
     # hive-subagent-daemon, hive-matrix-daemon, hive-matrix-mcp) are
     # wired via their own

nix/agent-modules/forge.nix

@@ -97,7 +97,7 @@ in
     environment.systemPackages = [
       # hive-forge <verb>: CLI wrapping common Forgejo REST API operations
       # (view, pr, issue, comment, assign, close, labels, branches, etc.).
-      # The per-bin split package — narrow closure, no hivectl/wireguard.
+      # The per-bin split package — narrow closure, no hivectl.
       config.services.hyperhive.agent.packages.hive-forge
     ]
     ++ lib.optional (config.services.hyperhive.agent.forge.url != null) gitCredHelper;