module-eval: evaluate shared fixture configs once

Thirty-three module-eval fixtures were a second (or later) full
`nixosSystem` evaluation of a config another fixture already evaluated:
16 shapes defined identically in two to seven cluster files, plus
duplicates inside agent-queue-bao, core-toggle and
swarm-services-switch. Each cluster imports ./lib.nix itself, so nothing
was shared between them.

nix/module-eval/shared.nix now defines each of those 16 shapes once.
nix/checks.nix instantiates it a single time and passes it as `shared`
to the 23 clusters that read one, and each cluster rebinds the fixture
under its existing local name. Assertions are unchanged. Case text
changes only in core-toggle, where two cases built the forge-host
fixture inline and now read the file's `forgeHere`, and in two inline
`let` bindings (bao-otel-collector, grafana) that now take the shared
fixture.

Six folds are value-equal rather than textually equal: they drop an
explicit `deploy.hive-controller.enable = false` or
`deploy.swarm-otel.enable = false` that equals what the option already
resolves to for that config. Nothing under nix/host-modules sets either
option apart from the `mkDefault allSwarmServices` on swarm-otel, and
the only option-priority read there is `domain.highestPrio`.

Part of #5171.

nix/module-eval/hive-tls.nix

@@ -11,6 +11,7 @@
   lib,
   self,
   nixosSystem,
+  shared,
 }:
 let
   inherit
@@ -29,9 +30,7 @@ let
 
   # Every service on one host, so the store's granting unit renders the role
   # this leaf is issued through.
-  allLocal = hiveWithController {
-    deploy.singleHostSwarm = true;
-  };
+  inherit (shared) allLocal;
 
   # The same host with the role's lifetime moved, so a threshold that is a
   # number of its own shows up as one that did not move with it.
@@ -66,7 +65,7 @@ let
   noPairFetch = noServiceNoPair.systemd.services.swarm-services-cert.script;
 
   # The same hive with no store identity at all.
-  noIdentity = hiveWithController { };
+  noIdentity = shared.bareWithController;
   noIdFetch = noIdentity.systemd.services.swarm-services-cert.script;
 
   # A gateway on a host with no hive and no store, fronting no swarm name,