swarm: move the queue's responder package to deploy

`swarm.nats.authPackage` is the callout responder's build — a host
decision like every other package in this slice — so it joins the
`deploy.nats` block that already holds `enable`, the seed paths and the
auto-mint toggle. Its one reader is the `ExecStart` in this file.

Three comments moved with it, and none of them survived the move
unedited:

- The "deliberately NO `package` option" note now says *anywhere* —
  it argued against a `package` under `swarm.nats`, and after the move
  a reader's next question is why there isn't one under `deploy.nats`
  either, where every other service's build now lives.
- The description's "see the note above" stopped resolving: the note
  is ~80 lines up and in a different option block, so it names
  `options.services.hyperhive.swarm.nats` explicitly.
- The split-rationale comment listed "the responder package" among
  what the queue IS to every hive. It's what the host running it
  decides, so it moved to that half of the sentence.

`flake.nix` writes this option (`lib.mkDefault`), so the writer is
repointed too — three of those left, all in the same block.

The eval fixture gains the old path rather than a new case: the shim
is what a dropped rename would break, and `natsOldPath` already fails
the eval if any single entry goes missing.

nix/module-eval.nix

@@ -110,7 +110,7 @@ let
   # The queue's callout identity, fourth split slice. `autoGenerateCallout` is
   # left FALSE on purpose: that is what makes the seed paths the thing deciding
   # `responderConfigured`, so the assertion below is about the seeds rather
-  # than about the auto-mint branch. All five old paths are defined, so
+  # than about the auto-mint branch. All six old paths are defined, so
   # dropping any single shim entry fails the eval, not just the arms read.
   natsOldPath = hive {
     deploy.nats.enable = true;
@@ -119,6 +119,7 @@ let
     swarm.nats.calloutIssuerPublicKey = "ATESTISSUERPUBKEYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
     swarm.nats.calloutUserSeedFile = "/run/secrets/nats-user.seed";
     swarm.nats.calloutIssuerSeedFile = "/run/secrets/nats-issuer.seed";
+    swarm.nats.authPackage = pkgs.emptyDirectory;
   };
 
   # Seventh split slice. Only `usersFile` has a rename entry: the other two