run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

nix/host-modules/hive-matrix.nix

@@ -13,6 +13,8 @@ let
   # the client is pointed at the server name instead.
   hyperhiveDomain = config.services.hyperhive.domain;
 
+  rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
+
   # Same runtime→build-time bridge hive-forge and swarm-ci-runner cross:
   # binds the hive trust bundle (which folds in the store's root) into the
   # container and orders the container after `hive-tls-ca.service`. The
@@ -1096,6 +1098,7 @@ in
     systemd.services."container@hive-matrix" = lib.mkMerge [
       { after = [ "dnsmasq.service" ]; }
       caTrust.containerOrdering
+      (rootfsCheck.warnOnly "hive-matrix")
     ];
   };
 }