swarm: extract the name guards, so the module just says what is forbidden

Her review: too much text, and an assertion helper instead of that much code
where the file should just say "this option cannot contain that".

`lib/name-guards.nix` gets `mustNotEqual` / `mustNotContain`; both call sites in
swarm-otel become four fields each — the option, the names, the list, and the
sentence explaining the failure. The message plumbing (find every offender,
quote them, name the list) is one shape shared by both.

Offenders are printed after their label rather than before it, because no
English verb agrees with both one name and five.

Converted the pre-existing equality assertion too. Leaving one hand-rolled
beside one helper-built is the worse of the two outcomes, and it is the same
guard.

Verified by evaluating both guards directly rather than only parsing: clean
rosters pass, `foo-agent`/`beehive` fail containment, `swarm` fails equality,
and `forgeworks`/`operator-hq` still pass — the control that keeps the two
lists from being merged.

nix/reserved-hive-fragments.nix

@@ -1,45 +1,19 @@
-# Words no HIVE name may CONTAIN — a substring blacklist, and the second half
-# of `./reserved-names.nix`.
+# Words no HIVE name may CONTAIN. The substring half of `./reserved-names.nix`.
 #
-# Two files rather than one list, because the two differ in every dimension
-# that matters and folding them would silently widen one of them:
-#
-#   | | `reserved-names.nix` | this file |
-#   |---|---|---|
-#   | subject | agent AND hive names | hive names only |
-#   | match | equality | substring |
-#   | why | the name IS a value some component emits | the word is a fixed SEGMENT of a derived identifier |
-#
-# ⚠️ That last row is the whole argument. `hive-<name>` and `hive-<name>-agent`
-# are built by composing a hive name with these words, so a hive called
-# `foo-agent` produces an id another hive's AGENTS also produce — the composed
-# strings collide even though the names do not. Equality cannot see that; only
-# containment can.
-#
-# ⇒ And it is why the sender words (`operator`, `system`, `forge`, …) are NOT
-# here: those are compared against a whole name, never embedded in one, so
-# applying containment to them would refuse `forgeworks` for no failure that
-# exists. `reserved-names.nix`'s own rule — an entry must name a real failure,
-# not a word that looked risky — governs this file too.
-#
-# Read by `host-modules/swarm-otel.nix`, which owns the hive-roster assertion.
-# Deliberately NOT exported to the Rust side: `HIVE_RESERVED_NAMES` answers
-# "may an AGENT be called this", which stays an equality question.
+# Separate because the two differ in every dimension: subject (hive names only
+# vs hive AND agent), matcher (substring vs equality), and admission rule (a
+# fixed segment of a COMPOSED identifier vs a value some component emits).
+# Folding them would widen the other one — containment over `forge` refuses
+# `forgeworks`, which names no failure.
 [
-  # `hive-<name>` — every hive's own OIDC client id (`swarm-authelia.nix`'s
-  # `hiveClientPrefix`), and the string the queue's auth-callout responder
-  # strips to decide which hive a connection is.
+  # `hive-<name>` — every hive's OIDC client id, and the string the queue's
+  # auth-callout responder strips to decide which hive a connection is.
   "hive"
-  # `hive-<name>-agent` — the client its agent containers present
-  # (`agentClientSuffix`). A hive named `foo-agent` mints exactly the id hive
-  # `foo`'s agents do, and the responder resolves it as the agents: that hive
-  # silently receives an agent grant instead of its own, and a NATS denial
-  # arrives as a timeout, so nothing names the cause.
+  # `hive-<name>-agent` — the client its agent containers present. A hive named
+  # `foo-agent` mints exactly the id hive `foo`'s agents do.
   "agent"
-  # Already in `reserved-names.nix` as an exact match, listed again here for
-  # the wider rule: the swarm collector names components `<kind>/<owner>` with
-  # the hive name as owner, and a name merely CONTAINING it is not a collision
-  # today — but `swarm` is the one word this swarm composes identifiers from
-  # everywhere, so the operator's rule covers it and the two files agree.
+  # Also an exact-match entry next door, for the collector's `<kind>/<owner>`
+  # components. Here because it is the word this swarm composes identifiers
+  # from everywhere.
   "swarm"
 ]