run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

nix/host-modules/hive-forge/default.nix

@@ -78,6 +78,8 @@ let
     deployCfg.bao.forgePublisherClientCertFile != null
     && deployCfg.bao.forgePublisherClientKeyFile != null;
 
+  rootfsCheck = import ../lib/container-rootfs-check.nix { inherit config; };
+
   caTrust = import ../lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
 
   # The container's journal forwarder pushes to its own receiver on the swarm
@@ -471,6 +473,7 @@ in
     # ../swarm-builder.nix's does.
     systemd.services."container@hive-forge" = lib.mkMerge [
       caTrust.containerOrdering
+      (rootfsCheck.warnOnly "hive-forge")
       {
         after = [ "swarm-bao-pki.service" ];
         wants = [ "swarm-bao-pki.service" ];