chore(nix): remove stale 'privsep phase 2' labels from comments

privsep is complete and always on. the phased-rollout framing
is historical — drop it from the inline comments, keeping the
accurate description of what the user + delegation actually do.

nix/modules/hive-c0re.nix

@@ -795,10 +795,9 @@ in
       managerToplevel
     ];
 
-    # Unprivileged coordinator user. hive-c0re runs as this user
-    # (privsep phase 2); privileged operations are delegated to
-    # hive-priv which runs as root, socket-activated at
-    # /run/hive/priv.sock.
+    # Unprivileged coordinator user. hive-c0re runs as this user;
+    # privileged operations are delegated to hive-priv which runs as
+    # root, socket-activated at /run/hive/priv.sock.
     users.users.hive-core = {
       isSystemUser = true;
       group = "hive-core";

nix/modules/hive-gateway.nix

@@ -423,7 +423,7 @@ in
     #
     # /run/hive-agent — per-agent UDS socket dir, written by c0re's
     # set_nspawn_flags when agents start. Owned by `hive-core` (the
-    # unprivileged coordinator user, privsep phase 2): c0re does the
+    # unprivileged coordinator user): c0re does the
     # `create_dir_all(/run/hive-agent/<name>)` itself, so a root-owned
     # parent would EACCES on the very first agent create on a fresh host
     # (hive-priv only chowns the subdir afterwards, it doesn't make it).