run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

nix/host-modules/lib/container-rootfs-check.nix

@@ -0,0 +1,32 @@
+# The pre-start check of a container's root, for one of hyperhive's own
+# declarative containers.
+#
+# nixpkgs' start script runs as host root against the container's own root,
+# which is persistent and writable by the container, and its `mkdir`, `chmod`,
+# `touch` and `cp` follow links the container planted there. `hive-priv
+# check-rootfs` looks at the paths the script touches (rules in
+# `hive-priv/src/prestart.rs`). With `--warn-only` it logs each violation at
+# warning level and lets the start go on; the agent containers run it strict
+# from their per-agent drop-in (hive-priv's `WriteResourceLimits`).
+#
+# Pure function, not a NixOS module. A container's module calls it with its
+# own name and folds the result into its unit:
+#
+#   rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
+#   #   systemd.services."container@${machine}" = lib.mkMerge [ (rootfsCheck.warnOnly machine) … ];
+#
+# The name list is the callers', never `config.containers`: that also holds
+# containers the operator runs that hyperhive doesn't own, and those get
+# nothing. nixpkgs renders each declarative container as its own
+# `container@<name>` unit (`nixos-containers.nix`, the `mapAttrsToList` that
+# builds `container@${name}`), so a setting on that unit reaches that
+# container only.
+{ config }:
+{
+  # Attributes for `systemd.services."container@<name>"`.
+  warnOnly = name: {
+    serviceConfig.ExecStartPre = [
+      "${config.services.hyperhive.c0re.package}/bin/hive-priv check-rootfs --warn-only ${name}"
+    ];
+  };
+}