run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

nix/host-modules/swarm-bao.nix

@@ -1689,6 +1689,8 @@ let
   forwarderAuthName = "oauth2client/${swarmOtelCfg.storeProducerName}";
   autheliaCfg = hyperhiveCfg.swarm.authelia;
 
+  rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
+
   # Outbound TLS for that collector: it dials the swarm collector's gateway
   # name and authelia's token endpoint, both leaves under the store's runtime
   # pki root, which cannot be baked into a derivation. Same helper, same two
@@ -4091,6 +4093,7 @@ in
       # cannot start is a store that is down.
       systemd.services."container@${cfg.machine}" = lib.mkMerge [
         caTrust.containerOrdering
+        (rootfsCheck.warnOnly cfg.machine)
         { after = [ "systemd-tmpfiles-resetup.service" ]; }
       ];