share the flake's pkgs in host module-eval fixtures

Each `hive` fixture imported its own nixpkgs. Pass the flake's pkgs
through nixpkgs.pkgs with nixpkgs' read-only module instead. On
module-eval-swarm-services-switch this drops nixpkgs instances from 52
to 23 and eval max RSS from 4.83 GiB to 3.28 GiB, with the same drvPath.

Agent fixtures keep their own nixpkgs: agent-modules sets
nixpkgs.config.allowUnfreePredicate, which a shared pkgs can't take.

nix/module-eval/lib.nix

@@ -37,11 +37,17 @@ let
   # Stub host, same shape ./docs/default.nix already uses: enough for a
   # `nixosSystem` to evaluate, nothing that pulls a real disk or
   # bootloader in.
+  #
+  # Every host fixture reuses the flake's `pkgs` rather than importing its own
+  # nixpkgs. `read-only.nix` makes any host module that defines top-level
+  # `nixpkgs.config`/`overlays`/`hostPlatform` fail the fixture's eval instead
+  # of being ignored.
   hive =
     extra:
     (nixosSystem {
-      system = pkgs.stdenv.hostPlatform.system;
       modules = [
+        (pkgs.path + "/nixos/modules/misc/nixpkgs/read-only.nix")
+        { nixpkgs.pkgs = pkgs; }
         self.nixosModules.default
         {
           fileSystems."/" = {