nix: add breaking-change note to each openFirewall description (argus #653)

argus picked option (a) on #653: put the upgrade note in each option's
`description` so it shows up in `nix flake show` + the rendered
options docs, right next to the option itself. cheapest option, no
eval-time noise (a `warnings` block would fire on every new
deployment that wants false — the normal case now).

Appended a `**Breaking change as of #651**` paragraph to each of the
three `openFirewall` descriptions, naming the exact option string the
operator needs to set to restore the old behaviour.

Gateway's note specifically calls out that external reach is the
common case (operator's primary entry point), so the upgrade hint
is most likely needed there.

nix/modules/hive-forge.nix

@@ -98,6 +98,11 @@ in
         the operator's browser / external git clients to hit the
         forge directly. (The container shares host netns, so this
         is the only firewall layer that matters.)
+
+        **Breaking change as of #651**: this used to default to
+        `true`. If you relied on the old default for external
+        reach, add `services.hyperhive.forge.openFirewall = true;`
+        to your host config before rebuilding.
       '';
     };
   };