run the root check warn-only on hyperhive's own containers, per unit, not on the container@ template

nix/module-eval/lib.nix

@@ -42,8 +42,8 @@ let
   # nixpkgs. `read-only.nix` makes any host module that defines top-level
   # `nixpkgs.config`/`overlays`/`hostPlatform` fail the fixture's eval instead
   # of being ignored.
-  hive =
-    extra:
+  hiveWith =
+    modules: extra:
     (nixosSystem {
       modules = [
         (pkgs.path + "/nixos/modules/misc/nixpkgs/read-only.nix")
@@ -70,9 +70,13 @@ let
             swarm.hives.h1.domain = "h1.t.local";
           } extra;
         }
-      ];
+      ]
+      ++ modules;
     }).config;
 
+  # `hiveWith` with no extra modules: the host a fixture normally is.
+  hive = hiveWith [ ];
+
   # `hive` with the hive-controller tier on (hive-c0re, the agent containers,
   # `deploy.hive-controller.*`). Only a fixture whose claim reads that tier
   # takes this; every other claim is about the swarm services and evaluates
@@ -299,7 +303,7 @@ let
     builtins.foldl' (acc: v: builtins.seq v acc) true vals;
 in
 {
-  inherit hive;
+  inherit hive hiveWith;
   inherit hiveWithController;
   inherit agent;
   inherit agentWith;