run the platform containers' root check through a build-independent path

nix/host-modules/lib/container-rootfs-check.nix

@@ -23,12 +23,19 @@
 # `container@<name>` unit (`nixos-containers.nix`, the `mapAttrsToList` that
 # builds `container@${name}`), so a setting on that unit reaches that
 # container only.
-{ config }:
-{
+#
+# The binary is run through `hivePriv`, a path that does not change with the hyperhive
+# build. `hive-priv.nix` points the symlink at the current package, so the
+# unit text is the same across builds and a switch does not restart the
+# container for it.
+{ ... }:
+rec {
+  hivePriv = "/run/hive-rootfs-check";
+
   # Attributes for `systemd.services."container@<name>"`.
   warnOnly = name: {
     serviceConfig.ExecStartPre = [
-      "-${config.services.hyperhive.deploy.hive-controller.package}/bin/hive-priv check-rootfs --warn-only ${name}"
+      "-${hivePriv} check-rootfs --warn-only ${name}"
     ];
   };
 }