chore(nix): trim stale body from deprecated isolateContainers option doc

The option is a no-op (marked DEPRECATED — ignored); the Prerequisite,
Migration, and Rust counterpart sections all described the migration that
already completed. Strip to just the deprecation notice.

Also fix the bridgeIp description: 'once netns isolation lands' is past
tense — isolation is unconditional now. Rephrase to present tense.

nix/modules/hive-network.nix

@@ -51,11 +51,11 @@ in
       example = "172.30.0.1";
       description = ''
         IPv4 address assigned to the bridge interface on the host
-        side. Becomes the DNS server address agents point at (and
-        the upstream the gateway proxies to once netns isolation
-        lands). Default `10.42.0.1` is in RFC 1918 space and
-        unlikely to clash with operator's existing setup; override
-        if a different range is already in use.
+        side. Agents use this address as their DNS server (dnsmasq
+        in the gateway container binds here). Default `10.42.0.1`
+        is in RFC 1918 space and unlikely to clash with operator's
+        existing setup; override if a different range is already in
+        use.
       '';
     };
 
@@ -127,46 +127,6 @@ in
         removed. This option is retained as a no-op so existing configs eval;
         setting it to `false` warns and has no effect. It will be removed in
         a future release.
-
-        Each agent container gets a dedicated veth
-        pair attached to `bridgeName` and a deterministic IP from
-        the bridge subnet. The bridge (already up when `enable = true`)
-        becomes the sole routed path between the host and agent
-        containers.
-
-        The host-side nix effect (this option) is:
-        - Sets `HIVE_NETWORK_ISOLATION=1` in the c0re service env so
-          the Rust lifecycle knows to pass `--private-network` +
-          bridge settings when creating/updating containers.
-        - Enables IP forwarding + NAT so agents can reach the internet
-          through the host.
-        - Adds a firewall rule DROP'ing traffic from the bridge subnet
-          to the host's loopback addresses — defence-in-depth so a
-          compromised agent can't reach the c0re dashboard (already
-          bound to 127.0.0.1) or other host-loopback services even if
-          the routing table somehow leaks.
-        - Allows HTTP/HTTPS (80/443) traffic from the bridge subnet to
-          the host so agents can reach the gateway container (shared
-          host netns, proxies the operator's per-agent UI).
-
-        **Prerequisite**: all agents must have
-        `hyperhive.web.useUnixSocket = true` before enabling isolation.
-        Agents that still bind TCP on `0.0.0.0:<port>` will be
-        reachable at their bridge IP from other agents on the same
-        subnet — defeating the isolation goal. The gateway routes via
-        unix sockets so gateway reach still works regardless.
-
-        **Migration**: containers are destroyed and re-created when
-        the network isolation flag flips. Operator state under
-        `/agents/<name>/state/` is bind-mounted and survives; the
-        container rootfs (nix store paths) is recreated cleanly.
-
-        **Rust counterpart**: `hive-c0re` reads `HIVE_NETWORK_ISOLATION`
-        and `HIVE_NETWORK_BRIDGE` from its service env and uses them in
-        `lifecycle::set_nspawn_flags` to configure `PRIVATE_NETWORK`,
-        `LOCAL_ADDRESS`, and `HOST_BRIDGE` in each container's
-        `nixos-containers/<name>.conf`. See `docs/network.md` for the
-        full design.
       '';
     };
   };