require network isolation, deleting the residual non-isolated branch

Per mara on #3725: the on/off toggle is removed, and required env vars
unset lead to a crash. HIVE_NETWORK_ISOLATION is gone from
hive-network.nix -- it was the toggle.

Validation happens once at daemon startup rather than per container.
The variables are process-global, so a bad value breaks every container
rather than one: failing at boot gives a single diagnostic naming the
bad value, and cannot reach a state where some containers were
configured before it was noticed.

Option<NetworkIsolation> collapses to NetworkIsolation through the wire
type, client and helper, which deletes the branch instead of leaving it
unreachable. serde(default) is dropped on that field deliberately: a
request omitting isolation is now rejected rather than defaulting to a
container sharing the host's network namespace.

What this replaces was a silent security downgrade. Of the four ways
into the old fallback, two logged nothing at all -- a container came up
without isolation and the journal agreed it was fine.

Doc comments that still described the removed branch are updated
(argus's note on #3723 scoped that to this issue). The hive-priv one is
a minimal edit inside the block #3723 rewrites; de-splicing is that
PR's job.

hive-c0re/src/main.rs

@@ -217,6 +217,15 @@ async fn main() -> Result<()> {
             if let Some(v) = build_slots {
                 sc.build_slots = v;
             }
+            // Network isolation is required and its settings are
+            // process-global, so a bad value breaks every container, not
+            // one. Validate once here: the unit then fails visibly at
+            // start with a single diagnostic naming the bad value,
+            // instead of coming up "healthy" and failing each container
+            // configure separately — possibly after some already
+            // succeeded.
+            lifecycle::network_isolation_from_env()
+                .context("network isolation settings are required at startup")?;
             cmd_serve(sc.env, sc.model_prices, sc.build_slots, db, &cli.socket).await
         }
     }