nix: remove the non-isolated (shared-netns) mode

Network isolation is validated working end to end (forge + matrix reach
the gateway under private netns), so the shared-host-netns mode is
removed — there is now one mode.

- hive-network.nix: the bridge/DNS block and the isolation overlay are
  now unconditional whenever hyperhive is enabled (gated on
  services.hyperhive.enable, not the per-feature toggles). The redundant
  isolateContainers-implies-enable guard is dropped.
- network.enable and isolateContainers are kept as DEPRECATED no-op
  options so existing configs that set them to true still evaluate
  cleanly; setting either to false now warns (gated on hyperhive being
  enabled, so a non-hyperhive host gets no spurious warning) and has no
  effect. Both are slated for removal in a future release.
- hive-c0re.nix: the HIVE_FORGE_URL / HIVE_MATRIX_URL conditionals drop
  the "&& isolateContainers" clause — agents always reach forge/matrix
  through the gateway vhost now.
- hive-matrix.nix: refresh one stale comment.

The Rust lifecycle is env-driven (HIVE_NETWORK_ISOLATION), so no Rust
change is needed: the env is now always set, so the existing
private-netns path always runs.

Supersedes the default-on flip (the option it would have defaulted is
gone).

nix/modules/hive-matrix.nix

@@ -377,7 +377,7 @@ in
           # `environment.etc."resolv.conf".text` is `nameserver <bridgeIp>`.
           # This container always shares the host netns
           # (`privateNetwork = false`), so it reaches `bridgeIp` regardless
-          # of `isolateContainers`. Network module off → inherit the host's
+          # of agent-container isolation. Network module off → inherit the host's
           # resolv.conf. See `docs/network.md`.
           networking = lib.mkMerge [
             (lib.mkIf networkCfg.enable {