feat: hive DNS always follows the host resolver

nix/host-modules/hive-gateway/dnsmasq.nix

@@ -27,10 +27,6 @@
     ];
     bind-interfaces = true;
     port = 53;
-    # Don't read /etc/resolv.conf — we control upstream explicitly to
-    # dodge dependency on the gateway container's own resolver state.
-    no-resolv = true;
-    server = networkCfg.upstreamDns;
     # Hive authoritative records — answer queries for the hive domain
     # + its sub-domains with the bridge IP, where nginx is reachable
     # from every container netns.
@@ -55,5 +51,11 @@
     # containers such as hive-ci) receive their IPs dynamically.
     dhcp-range = "${networkCfg.dhcpRangeStart},${networkCfg.dhcpRangeEnd},1h";
     dhcp-leasefile = "/var/lib/dnsmasq/dnsmasq.leases";
+    # No explicit upstream: non-hive queries follow dnsmasq's
+    # resolv.conf default — the gateway container's `/etc/resolv.conf`,
+    # which nixos-container copies from the host at every start, so the
+    # hive always uses the host's resolvers. resolvconf is disabled in
+    # the container (see ./default.nix) so nothing regenerates that
+    # copy.
   };
 }