module-eval: evaluate shared fixture configs once

Thirty-three module-eval fixtures were a second (or later) full
`nixosSystem` evaluation of a config another fixture already evaluated:
16 shapes defined identically in two to seven cluster files, plus
duplicates inside agent-queue-bao, core-toggle and
swarm-services-switch. Each cluster imports ./lib.nix itself, so nothing
was shared between them.

nix/module-eval/shared.nix now defines each of those 16 shapes once.
nix/checks.nix instantiates it a single time and passes it as `shared`
to the 23 clusters that read one, and each cluster rebinds the fixture
under its existing local name. Assertions are unchanged. Case text
changes only in core-toggle, where two cases built the forge-host
fixture inline and now read the file's `forgeHere`, and in two inline
`let` bindings (bao-otel-collector, grafana) that now take the shared
fixture.

Six folds are value-equal rather than textually equal: they drop an
explicit `deploy.hive-controller.enable = false` or
`deploy.swarm-otel.enable = false` that equals what the option already
resolves to for that config. Nothing under nix/host-modules sets either
option apart from the `mkDefault allSwarmServices` on swarm-otel, and
the only option-priority read there is `domain.highestPrio`.

Part of #5171.

nix/module-eval/bao-controller.nix

@@ -6,6 +6,7 @@
   lib,
   self,
   nixosSystem,
+  shared,
 }:
 let
   inherit
@@ -43,7 +44,7 @@ let
   # The controller with no store, which is every spread deployment. Nothing
   # mints here, so the pairing must leave the paths unset rather than name
   # files this host will never have.
-  controllerNoStore = hive { deploy.swarm-controller.enable = true; };
+  controllerNoStore = shared.controllerAlone;
 
   # A deployment that pinned `gatewayHost` away from its own swarm-domain
   # default (`hive-matrix-service.nix`'s own doc: "To use the per-hive name