docs(gateway): describe what is, not what changed

Per review: docs represent current state. Every "used to" / "no longer"
clause this branch introduced is gone — including the History section in
network.md, which was a whole subsection about a sync mechanism that
doesn't exist.

Where the removed clause was carrying a real constraint, the constraint
stays and is stated in the present tense instead of as a delta: nothing
narrows what the gateway's nginx can reach except the directory
permissions in front of a socket, and nothing bounds `ReloadGatewayNginx`
except the hard-coded unit name. Those read as rules now rather than as
the story of how they came to be rules.

docs/gateway.md

@@ -122,12 +122,9 @@ now set unconditionally for every agent. The mechanism:
    - failed → `systemctl reset-failed nginx` + `systemctl start nginx`
    - otherwise → `systemctl start nginx`
    This is an explicit trigger rather than a path unit watching the
-   file. It used to be *impossible* to do it any other way — `IN_MOVED_TO`
-   from the atomic rename did not cross the nspawn mount-namespace
-   boundary, so an in-container path unit never fired. With nginx on the
-   host a path unit would now work, and it is still not wanted: the write
-   and the reload belong in one causal chain c0re can retry and report on
-   (`RELOAD_PENDING`), not two units racing on an inotify event.
+   file: the write and the reload belong in one causal chain c0re can
+   retry and report on (`RELOAD_PENDING`), not two units racing on an
+   inotify event.
 
 c0re regenerates `agents.conf` (and triggers a reload) on two
 triggers: every topology change (new/removed agents) and every 10s
@@ -200,7 +197,7 @@ On by default, and listens on `httpsPort` (default 443) on every vhost beside th
 
 The issuer is a **host-held hive CA**, not a bare self-signed leaf. A host service (`hive-tls-ca.service`, from the `hive-tls` module) generates a long-lived CA (`services.hyperhive.tls.caValidityDays`, default ~20y) under `services.hyperhive.tls.stateDir` (default `/var/lib/hive-tls`), then signs a gateway **leaf** (`leafValidityDays`, default 30d) with it. `hive-gateway-self-signed-cert` then imports the leaf into nginx's state dir (`/var/lib/hive-gateway/tls/{cert,key}.pem`).
 
-⚠️ **That import unit is not a leftover of the old container — do not collapse it into pointing nginx at the CA dir.** It does two jobs. It re-modes the leaf (`hive-tls-ca` writes the key `0600 root:root`; nginx's pre-start `nginx -t` runs as the *nginx user*, so a `0600` key fails the config test and blocks the unit), and it guarantees **every cert path the nginx config names exists** — which is what the swarm-services fallback below is for. Removing it re-creates the #3097 outage.
+⚠️ **Do not collapse that import unit into pointing nginx at the CA dir.** It does two jobs. It re-modes the leaf (`hive-tls-ca` writes the key `0600 root:root`; nginx's pre-start `nginx -t` runs as the *nginx user*, so a `0600` key fails the config test and blocks the unit), and it guarantees **every cert path the nginx config names exists** — which is what the swarm-services fallback below is for. Removing it re-creates the #3097 outage.
 
 **Why a CA, not a bare leaf**: a bare self-signed leaf is its own trust anchor, so every regeneration is a new anchor every consumer must re-trust — and a runtime-generated leaf can't be wired into an agent's build-time trust store at all. With a stable CA, agents and federation peers trust it *once*; leaf rotation never re-breaks them.
 
@@ -433,9 +430,7 @@ any content change — so `max-age=31536000` is safe.
 **Why the nix store path resolves**: `HIVE_AGENT_FRONTEND_DIR` is a nix
 store path baked in at hive-c0re build time, and c0re (writing
 `agents.conf`) and nginx (serving files from it) are on the same machine,
-so they see the same store. This used to need explaining — nspawn
-bind-mounts `/nix/store` read-only into a container, which is what made
-the baked-in path work from inside the gateway.
+so they see the same store.
 
 **Graceful degradation**: if `HIVE_AGENT_FRONTEND_DIR` is empty or
 unset (e.g. a build that predates `cfg.frontend`), each agent gets the