matrixAccounts: assert no extra named 'main' (reserved for hive account)

nix/templates/harness-base.nix

@@ -770,6 +770,14 @@ in
           + "(the extras extend the hive-internal `main` account, which only "
           + "exists when matrix is enabled).";
       }
+      # `main` is reserved for the synthesized hive-internal account; a
+      # declared extra by that name would silently collide with it.
+      {
+        assertion = !builtins.hasAttr "main" config.hyperhive.matrixAccounts;
+        message =
+          "hyperhive.matrixAccounts cannot contain a key named \"main\" "
+          + "--- that name is reserved for the hive-internal account.";
+      }
       # hyperhive.frontend.extraFiles[*].target is concatenated into
       # $out during the mergedDist build. The option's strMatching
       # type already rejects leading `/`, leading `.`, and the