module-eval: evaluate shared fixture configs once

Thirty-three module-eval fixtures were a second (or later) full
`nixosSystem` evaluation of a config another fixture already evaluated:
16 shapes defined identically in two to seven cluster files, plus
duplicates inside agent-queue-bao, core-toggle and
swarm-services-switch. Each cluster imports ./lib.nix itself, so nothing
was shared between them.

nix/module-eval/shared.nix now defines each of those 16 shapes once.
nix/checks.nix instantiates it a single time and passes it as `shared`
to the 23 clusters that read one, and each cluster rebinds the fixture
under its existing local name. Assertions are unchanged. Case text
changes only in core-toggle, where two cases built the forge-host
fixture inline and now read the file's `forgeHere`, and in two inline
`let` bindings (bao-otel-collector, grafana) that now take the shared
fixture.

Six folds are value-equal rather than textually equal: they drop an
explicit `deploy.hive-controller.enable = false` or
`deploy.swarm-otel.enable = false` that equals what the option already
resolves to for that config. Nothing under nix/host-modules sets either
option apart from the `mkDefault allSwarmServices` on swarm-otel, and
the only option-priority read there is `domain.highestPrio`.

Part of #5171.

nix/module-eval/shared.nix

@@ -0,0 +1,96 @@
+# The fixtures more than one `checks.module-eval-*` cluster reads, each
+# evaluated once. ../checks.nix imports this file once and hands the result to
+# every cluster that uses one; a cluster rebinds the fixture under its own
+# local name.
+#
+# ⚠️ Sharing only pays when ../checks.nix instantiates this file ONCE: a
+# cluster that ran `import ./shared.nix` itself would get its own copy of
+# every fixture, the same as defining them locally. The cost is that each
+# fixture here stays live for the whole evaluation rather than one cluster's.
+#
+# Holds only configs that are identical across their users. A cluster whose
+# claim needs one more option set defines its own fixture.
+{
+  pkgs,
+  lib,
+  self,
+  nixosSystem,
+}:
+let
+  inherit
+    (import ./lib.nix {
+      inherit
+        pkgs
+        lib
+        self
+        nixosSystem
+        ;
+    })
+    hive
+    hiveWithController
+    agent
+    agentWith
+    ;
+in
+{
+  agentBare = agent { };
+
+  agentWithBao = agentWith { services.hyperhive.agent.bao.addr = "https://bao.t.local:8200"; };
+
+  bare = hive { };
+
+  bareWithController = hiveWithController { };
+
+  allLocal = hiveWithController { deploy.singleHostSwarm = true; };
+
+  autheliaOnly = hive { deploy.authelia.enable = true; };
+
+  forgeHere = hive { deploy.forgejo.enable = true; };
+
+  baoOnly = hive { deploy.bao.enable = true; };
+
+  servicesHere = hive { deploy.allSwarmServices = true; };
+
+  controllerAlone = hive { deploy.swarm-controller.enable = true; };
+
+  matrixNoBaoIdentity = hiveWithController { deploy.matrix.enable = true; };
+
+  baoWithMatrix = hiveWithController {
+    deploy.bao.enable = true;
+    deploy.matrix.enable = true;
+  };
+
+  # A second job declared as bare `host:port`, so a case can read one rendered
+  # scrape list where the store's entry carries a path and this one carries
+  # none.
+  baoWithCollector = hive {
+    deploy.bao.enable = true;
+    deploy.swarm-otel.enable = true;
+    swarm.otel.scrapeTargets.plain = "127.0.0.1:9999";
+  };
+
+  # `clientSecretFile` is what ../host-modules/otel.nix's identity assertion
+  # demands of any hive with the tier on.
+  baoWithHiveOtel = hive {
+    deploy.bao.enable = true;
+    otel.enable = true;
+    otel.clientSecretFile = "/var/lib/hive-otel-oidc/client.secret";
+  };
+
+  # The swarm collector with the IdP on another host and the store leaf placed
+  # by hand, without and with the collector's own OIDC pair.
+  otelReaderMissingLeaf = hive {
+    deploy.swarm-otel.enable = true;
+    swarm.authelia.url = "https://auth.example.invalid";
+    deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
+    deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
+  };
+  otelReaderNamedInFull = hive {
+    deploy.swarm-otel.enable = true;
+    swarm.authelia.url = "https://auth.example.invalid";
+    deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
+    deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
+    deploy.bao.otelOidcClientCertFile = "/etc/pki/bao-otel-oidc.pem";
+    deploy.bao.otelOidcClientKeyFile = "/etc/pki/bao-otel-oidc-key.pem";
+  };
+}