nix: remove the non-isolated (shared-netns) mode

Network isolation is validated working end to end (forge + matrix reach
the gateway under private netns), so the shared-host-netns mode is
removed — there is now one mode.

- hive-network.nix: the bridge/DNS block and the isolation overlay are
  now unconditional whenever hyperhive is enabled (gated on
  services.hyperhive.enable, not the per-feature toggles). The redundant
  isolateContainers-implies-enable guard is dropped.
- network.enable and isolateContainers are kept as DEPRECATED no-op
  options so existing configs that set them to true still evaluate
  cleanly; setting either to false now warns (gated on hyperhive being
  enabled, so a non-hyperhive host gets no spurious warning) and has no
  effect. Both are slated for removal in a future release.
- hive-c0re.nix: the HIVE_FORGE_URL / HIVE_MATRIX_URL conditionals drop
  the "&& isolateContainers" clause — agents always reach forge/matrix
  through the gateway vhost now.
- hive-matrix.nix: refresh one stale comment.

The Rust lifecycle is env-driven (HIVE_NETWORK_ISOLATION), so no Rust
change is needed: the env is now always set, so the existing
private-netns path always runs.

Supersedes the default-on flip (the option it would have defaulted is
gone).

nix/modules/hive-c0re.nix

@@ -756,10 +756,13 @@ in
         #   needed — nginx proxies to forgejo as it does for the operator.
         # - Shared netns: host loopback is reachable, use direct port.
         # See `docs/gateway.md::HIVE_FORGE_URL`.
+        # Network isolation is now unconditional (the shared-netns mode was
+        # removed), so agents always reach the forge through the gateway
+        # vhost rather than host loopback. The `network.enable` guard remains
+        # only so a deliberately network-less deployment still falls back to
+        # loopback; in the normal case it is always on.
         HIVE_FORGE_URL =
-          if
-            config.services.hyperhive.network.enable && config.services.hyperhive.network.isolateContainers
-          then
+          if config.services.hyperhive.network.enable then
             "http://${config.services.hyperhive.forge.domain}"
           else
             "http://127.0.0.1:${toString config.services.hyperhive.forge.httpPort}";
@@ -767,19 +770,17 @@ in
       // lib.optionalAttrs config.services.hyperhive.matrix.enable {
         # In-cluster matrix homeserver URL for each agent's
         # hive-matrix-daemon. Same shape + rationale as HIVE_FORGE_URL:
-        # - Isolated (private netns): reach tuwunel via the gateway vhost
-        #   (`matrix.<domain>`) on plain http:80 — host loopback is dead.
-        # - Shared netns: direct host loopback on the tuwunel port.
-        # gatewayHost null-guard falls back to loopback so a domain-less
-        # config doesn't break eval (it just won't work under isolation,
-        # which needs a gateway anyway). Forwarded to agents by meta.rs
-        # alongside HIVE_FORGE_URL; shares the same env-forwarding ordering
-        # caveat (value baked at config-generation time).
+        # network isolation is now unconditional, so agents reach tuwunel
+        # via the gateway vhost (`matrix.<domain>`) on plain http:80 rather
+        # than host loopback. The gatewayHost null-guard falls back to
+        # loopback so a domain-less config still evals; the `network.enable`
+        # guard covers a deliberately network-less deployment. Forwarded to
+        # agents by meta.rs alongside HIVE_FORGE_URL; shares the same
+        # env-forwarding ordering caveat (value baked at config-generation
+        # time).
         HIVE_MATRIX_URL =
           if
-            config.services.hyperhive.network.enable
-            && config.services.hyperhive.network.isolateContainers
-            && config.services.hyperhive.matrix.gatewayHost != null
+            config.services.hyperhive.network.enable && config.services.hyperhive.matrix.gatewayHost != null
           then
             "http://${config.services.hyperhive.matrix.gatewayHost}"
           else