run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

nix/host-modules/swarm-victorialogs.nix

@@ -99,6 +99,8 @@ let
   # one word.
   oneWord = path: builtins.match ".*[[:space:]].*" path == null;
 
+  rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
+
   # The forwarder reaches the swarm collector and authelia by name over TLS; in
   # self-signed mode their leaves chain to the hive CA.
   caTrust = import ./lib/hive-ca-trust.nix {
@@ -290,6 +292,7 @@ in
     # ordering keeps the trust bundle's bind source there first.
     systemd.services."container@${cfg.machine}" = lib.mkMerge [
       caTrust.containerOrdering
+      (rootfsCheck.warnOnly cfg.machine)
       {
         after = [ "swarm-bao-pki.service" ];
         wants = [ "swarm-bao-pki.service" ];