hive-matrix: reject an override of registrationTokenFile instead of desyncing hive-c0re

nix/module-eval.nix

@@ -296,6 +296,21 @@ let
         builtins.elem httpPort ports
         && matrixOldPath.containers.hive-matrix.bindMounts ? "/etc/matrix/register.token";
     }
+    {
+      # registrationTokenFile lost its override capability entirely
+      # (bao-delivered secrets don't need one — glue-matrix-bao-token.nix
+      # already writes into the fixed path instead of moving it), unlike its
+      # five siblings in the same rename. `matrixOldPath` above proves the
+      # override still *resolves* (mkDefault, not a crash) — this proves it
+      # also gets *rejected*, by a named assertion rather than nixpkgs' generic
+      # conflicting-definition text. Reads `.assertions` directly (cheap: a
+      # list of `{assertion; message;}`, not `system.build.toplevel`) rather
+      # than forcing a real build just to observe a boolean.
+      name = "overriding registrationTokenFile (even via the pre-rename shim) trips a named assertion, not a silent desync";
+      ok = lib.any (
+        a: !a.assertion && lib.hasInfix "registrationTokenFile" a.message
+      ) matrixOldPath.assertions;
+    }
     {
       # Reads the DELIVERY UNIT, not the options: `responderConfigured` gates
       # whether it exists at all, and the seed path is interpolated into its