run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

nix/host-modules/swarm-notify-router.nix

@@ -44,6 +44,8 @@ let
   # containers' forwarders all the same.
   forwarderTelemetryPort = 8902;
 
+  rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
+
   # The daemon reaches authelia, the store and the queue by name over TLS, and
   # in self-signed mode their leaves chain to the hive CA.
   caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
@@ -134,6 +136,7 @@ in
     # missing, so where this host mints the leaf the container waits for it.
     systemd.services."container@${machine}" = lib.mkMerge [
       caTrust.containerOrdering
+      (rootfsCheck.warnOnly machine)
       { after = [ "swarm-bao-pki.service" ]; }
     ];