nix: remove the non-isolated (shared-netns) mode

Network isolation is validated working end to end (forge + matrix reach
the gateway under private netns), so the shared-host-netns mode is
removed — there is now one mode.

- hive-network.nix: the bridge/DNS block and the isolation overlay are
  now unconditional whenever hyperhive is enabled (gated on
  services.hyperhive.enable, not the per-feature toggles). The redundant
  isolateContainers-implies-enable guard is dropped.
- network.enable and isolateContainers are kept as DEPRECATED no-op
  options so existing configs that set them to true still evaluate
  cleanly; setting either to false now warns (gated on hyperhive being
  enabled, so a non-hyperhive host gets no spurious warning) and has no
  effect. Both are slated for removal in a future release.
- hive-c0re.nix: the HIVE_FORGE_URL / HIVE_MATRIX_URL conditionals drop
  the "&& isolateContainers" clause — agents always reach forge/matrix
  through the gateway vhost now.
- hive-matrix.nix: refresh one stale comment.

The Rust lifecycle is env-driven (HIVE_NETWORK_ISOLATION), so no Rust
change is needed: the env is now always set, so the existing
private-netns path always runs.

Supersedes the default-on flip (the option it would have defaulted is
gone).

nix/modules/hive-network.nix

@@ -19,18 +19,18 @@ in
       defaultText = lib.literalExpression "config.services.hyperhive.enable";
       example = false;
       description = ''
-        Stand up the hive-internal bridge + dnsmasq resolver.
-        Defaults to `config.services.hyperhive.enable` so it comes
-        on automatically with the rest of hyperhive. Requires
-        `services.hyperhive.domain` to be set — the dnsmasq resolver
-        is authoritative for `<hive-domain>` and its sub-domains.
-        When enabled: a bridge interface (`bridgeName`) appears on the
-        host with `bridgeIp` assigned, and the hive-gateway container
-        runs a dnsmasq listening on that IP for `<hive-domain>` +
-        sub-domains. Agent containers still default to shared host
-        netns — the endpoint is up but only used once
-        `isolateContainers = true` flips containers to private netns
-        + veth peers on this bridge.
+        **DEPRECATED — ignored.** The hive network (bridge + dnsmasq
+        resolver + private-netns isolation) is now always on whenever
+        hyperhive is enabled; setting this to `false` warns and has no
+        effect. Retained as a no-op so existing configs eval; will be
+        removed in a future release.
+
+        The network requires `services.hyperhive.domain` to be set — the
+        dnsmasq resolver is authoritative for `<hive-domain>` and its
+        sub-domains. A bridge interface (`bridgeName`) appears on the host
+        with `bridgeIp` assigned, the hive-gateway container runs a dnsmasq
+        on that IP, and each agent container runs in a private netns with a
+        veth pair on the bridge.
       '';
     };
 
@@ -94,11 +94,16 @@ in
 
     isolateContainers = lib.mkOption {
       type = lib.types.bool;
-      default = false;
+      default = true;
       example = true;
       description = ''
-        Flip agent containers from shared host netns to private netns.
-        When true, each agent container gets a dedicated veth
+        **DEPRECATED — ignored.** Network isolation is now the only mode and
+        is always on whenever hyperhive is enabled; the shared-netns path was
+        removed. This option is retained as a no-op so existing configs eval;
+        setting it to `false` warns and has no effect. It will be removed in
+        a future release.
+
+        Each agent container gets a dedicated veth
         pair attached to `bridgeName` and a deterministic IP from
         the bridge subnet. The bridge (already up when `enable = true`)
         becomes the sole routed path between the host and agent
@@ -142,21 +147,27 @@ in
   };
 
   config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
+    # The hive network + container isolation are unconditional whenever
+    # hyperhive is enabled: the shared-netns mode was removed, so there is
+    # one mode (private netns behind the bridge). `network.enable` and
+    # `isolateContainers` are kept as deprecated no-op options (see the
+    # warnings block below) so existing configs that set them still eval.
+    (lib.mkIf config.services.hyperhive.enable {
       assertions = [
         {
           assertion = config.services.hyperhive.domain != null;
           message = ''
-            services.hyperhive.network.enable = true requires
-            services.hyperhive.domain to be set — the resolver needs a
-            domain to be authoritative for. Either pin a hostname
-            (`services.hyperhive.domain = "example.com";`) or set
-            `services.hyperhive.network.enable = false` explicitly.
+            hyperhive requires services.hyperhive.domain to be set — the
+            hive resolver is authoritative for `<hive-domain>` and its
+            sub-domains, and agents reach the forge/matrix through the
+            gateway by that domain. Pin a hostname
+            (`services.hyperhive.domain = "example.com";`).
           '';
         }
       ];
 
-      # Virtual bridge — veth pairs attach when isolateContainers flips on.
+      # Virtual bridge — each agent container attaches a veth pair (isolation
+      # is unconditional now).
       networking.bridges.${cfg.bridgeName}.interfaces = [ ];
 
       # Bridge IP — dnsmasq (in the gateway container) binds here.
@@ -174,23 +185,9 @@ in
       };
     })
 
-    # Guard: fires unconditionally on isolateContainers so the assertion
-    # is not silently swallowed when enable=false.
-    (lib.mkIf cfg.isolateContainers {
-      assertions = [
-        {
-          assertion = cfg.enable;
-          message = ''
-            services.hyperhive.network.isolateContainers = true requires
-            services.hyperhive.network.enable = true (the bridge and
-            resolver must be running before isolation is flipped on).
-          '';
-        }
-      ];
-    })
-
-    # Container isolation overlay — see docs/network.md#container-isolation.
-    (lib.mkIf (cfg.enable && cfg.isolateContainers) {
+    # Container isolation overlay — now unconditional (the shared-netns
+    # mode was removed). See docs/network.md#container-isolation.
+    (lib.mkIf config.services.hyperhive.enable {
 
       # Agents route internet traffic via the bridge; NAT masquerades their RFC-1918 IPs.
       boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
@@ -222,5 +219,27 @@ in
         HIVE_NETWORK_SUBNET = "${cfg.bridgeIp}/${toString cfg.bridgePrefixLength}";
       };
     })
+
+    # Deprecation surface for the removed toggles. Both options are kept so
+    # existing configs that set them to `true` still eval cleanly; setting
+    # either to `false` no longer does anything (network + isolation are
+    # unconditional now), so warn rather than silently ignore.
+    {
+      # Only warn when hyperhive itself is enabled — otherwise `cfg.enable`
+      # defaults to `false` (tracking `hyperhive.enable`) and we'd fire a
+      # spurious deprecation warning on a host that doesn't run hyperhive.
+      warnings = lib.optionals config.services.hyperhive.enable (
+        lib.optional (!cfg.enable) ''
+          services.hyperhive.network.enable = false is deprecated and ignored
+          — the hive network is now always on (private-netns isolation is the
+          only mode). Remove the setting.
+        ''
+        ++ lib.optional (!cfg.isolateContainers) ''
+          services.hyperhive.network.isolateContainers = false is deprecated
+          and ignored — network isolation is now the only mode and is always
+          on. Remove the setting.
+        ''
+      );
+    }
   ];
 }