run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

nix/host-modules/swarm-authelia.nix

@@ -183,6 +183,8 @@ let
   refreshConsumer = import ./lib/refresh-consumer.nix { };
   storeSeededSecret = import ./lib/store-seeded-secret.nix { };
 
+  rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
+
   caTrust = import ./lib/hive-ca-trust.nix {
     inherit lib gatewayCfg;
     tlsCfg = deployCfg.hive-controller.tls;
@@ -970,6 +972,7 @@ in
     # not be up.
     systemd.services."container@${cfg.machine}" = lib.mkMerge [
       caTrust.containerOrdering
+      (rootfsCheck.warnOnly cfg.machine)
       (lib.mkIf publishes {
         after = [ "swarm-bao-pki.service" ];
         wants = [ "swarm-bao-pki.service" ];