Fix nix references in prose that no longer resolve

Nine of the 38 .nix tokens mentioned anywhere in *.rs did not name
anything that exists. Twelve mentions, five distinct targets:
hive-c0re.nix, hive-gateway.nix and hive-forge.nix are all directories
now; nix/modules/ is not a directory we have; hive-forge-tools.nix was
a bash script the binary replaced and is gone.

Where the reference is load-bearing it is corrected rather than
deleted, because the reference is the point: a comment saying a
constant must match a nix literal is only useful if you can open the
file it names. Where the module member was unambiguous the path now
names it exactly.

paths.rs's STATE_ROOT marker was the worst of them: it claimed the
value came from services.hyperhive.c0re.statePath, in hive-c0re.nix.
Neither exists. The option is not declared anywhere and the file is a
directory, so a "must match" contract pointed at two things that
cannot be opened. /var/lib/hyperhive is hardcoded on both sides, which
is what the comment now says.

hive-forge-tools.nix keeps no replacement: naming a file that was
deliberately deleted helps nobody, and "replaces a prior bash script"
is complete without it.

Measured before and after with the same command: 9 unresolved of 38
before, 4 of 35 after. The remaining four are an example path in a doc
comment, an upstream nixpkgs path, and two from one synthetic test
fixture.

hive-forge/src/main.rs

@@ -13,8 +13,8 @@
 //! `forge-<label>.json` (base URL) from the state dir rather than
 //! `HIVE_FORGE_URL`/`forge-token`. See `client::Client::from_env`.
 //!
-//! Single binary with verb subcommands. Replaces the prior bash
-//! script (`hive-forge-tools.nix`) so that agents and operators get
+//! Single binary with verb subcommands. Replaces a prior bash
+//! script so that agents and operators get
 //! the same error handling, exit codes, and JSON shapes regardless
 //! of how the bash mood was that day.