run the platform containers' root check through a build-independent path

nix/host-modules/hive-priv.nix

@@ -9,13 +9,19 @@
 }:
 let
   controllerCfg = config.services.hyperhive.deploy.hive-controller;
+  rootfsCheck = import ./lib/container-rootfs-check.nix { inherit config; };
 in
 {
   config = lib.mkIf config.services.hyperhive.deploy.hive-controller.enable {
     # The parent of every agent socket dir. hive-priv is its only writer
     # (`EnsureAgentSocketDir`), and its unit lists it in `ReadWritePaths`,
     # which fails the unit when the path is missing.
-    systemd.tmpfiles.rules = [ "d /run/hive-agent 0755 root root - -" ];
+    systemd.tmpfiles.rules = [
+      "d /run/hive-agent 0755 root root - -"
+      # The platform containers run their warn-only root check by this path
+      # (`lib/container-rootfs-check.nix`), so their units carry no store path.
+      "L+ ${rootfsCheck.hivePriv} - - - - ${controllerCfg.package}/bin/hive-priv"
+    ];
 
     # Socket unit for hive-priv — the narrow root helper that executes
     # privileged operations on behalf of hive-c0re. Systemd creates and

nix/host-modules/lib/container-rootfs-check.nix

@@ -23,12 +23,19 @@
 # `container@<name>` unit (`nixos-containers.nix`, the `mapAttrsToList` that
 # builds `container@${name}`), so a setting on that unit reaches that
 # container only.
-{ config }:
-{
+#
+# The binary is run through `hivePriv`, a path that does not change with the hyperhive
+# build. `hive-priv.nix` points the symlink at the current package, so the
+# unit text is the same across builds and a switch does not restart the
+# container for it.
+{ ... }:
+rec {
+  hivePriv = "/run/hive-rootfs-check";
+
   # Attributes for `systemd.services."container@<name>"`.
   warnOnly = name: {
     serviceConfig.ExecStartPre = [
-      "-${config.services.hyperhive.deploy.hive-controller.package}/bin/hive-priv check-rootfs --warn-only ${name}"
+      "-${hivePriv} check-rootfs --warn-only ${name}"
     ];
   };
 }