remove the swarm wireguard mesh; tombstone its options

nix/host-modules/deploy.nix

@@ -74,6 +74,14 @@ let
     The snapshot store was removed; agent-state backups are being rebuilt as
     swarm-archive. Remove this definition.
   '';
+
+  # Shared by the removed options of the WireGuard mesh.
+  wireguardRemoved = ''
+    The WireGuard mesh was removed. bao and nats are reached through
+    their routable listeners (`services.hyperhive.deploy.bao.extraListenAddresses`
+    with `openFirewall`, and `services.hyperhive.deploy.nats.openFirewall`; both
+    off by default). Remove this definition.
+  '';
 in
 {
   imports = [
@@ -181,6 +189,41 @@ in
       "snapshotStore"
       "port"
     ] snapshotStoreRemoved)
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "deploy"
+      "wireguard"
+      "enable"
+    ] wireguardRemoved)
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "deploy"
+      "wireguard"
+      "privateKeyFile"
+    ] wireguardRemoved)
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "deploy"
+      "wireguard"
+      "address"
+    ] wireguardRemoved)
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "deploy"
+      "wireguard"
+      "listenPort"
+    ] wireguardRemoved)
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "deploy"
+      "wireguard"
+      "persistentKeepalive"
+    ] wireguardRemoved)
 
     # Same type, same meaning, new path — so a rename carries it exactly
     # and existing configs keep evaluating with one warning naming both