hive-priv: the call-site comment too, not just the function's doc

The inline comment above write_bridge_dns_marker still said the marker
is 'written on isolate, removed otherwise, so the same shared container
toplevel behaves correctly in both modes'. There is one mode now.

Caught because argus pointed out that reading every changed function's
doc comment does not cover comments at the call sites -- the complete
form is to read every comment in the context around each hunk, which is
what git diff -U15 shows.

hive-priv/src/main.rs

@@ -2797,8 +2797,8 @@ fn write_nspawn_flags(
     // anyway). The `hyperhive-isolated-dns` oneshot in harness-base.nix
     // rewrites resolv.conf to point at the bridge resolver, but only when
     // this marker exists; it carries the gateway IP so the container
-    // doesn't have to re-derive it. Written on isolate, removed otherwise,
-    // so the same shared container toplevel behaves correctly in both modes.
+    // doesn't have to re-derive it. Always written — every container is
+    // isolated, so there is no mode in which the marker should be absent.
     write_bridge_dns_marker(container, isolation)?;
     Ok(())
 }