docs(3191): drop the migration history from the gateway comments

Per mara on the PR: how a thing used to be deployed stops being
relevant the moment this is merged and the hives are rebuilt, so the
comments state the current constraint and nothing about the container
that used to hold it.

Removes the two ⚠️ blocks this PR added (hive-tls-ca's ordering, the
resign propagation), the matrix ordering's, dnsmasq's resolv.conf
paragraph, and the pre-existing 'REMOVED WITH THE CONTAINER' inventory
in the gateway module. The 🚨 do-not-simplify warning on the cert-copy
unit keeps both its reasons and loses the container framing.

Kept deliberately: the two operator-facing 'this used to default to
true' option notes (migration information for someone upgrading), and
the SupplementaryGroups block, which documents why an absence is
load-bearing rather than how a deployment used to look.

nix/host-modules/hive-matrix.nix

@@ -591,14 +591,6 @@ in
     # boot requirement. Soft `after` ordering (not `requires`) keeps the
     # matrix container's lifecycle decoupled from the resolver's.
     #
-    # ⚠️ This named `container@hive-gateway.service` until the gateway
-    # moved onto the host: dnsmasq lived in that container, so ordering
-    # after the container was how you ordered after the resolver. The
-    # container is gone and dnsmasq is a plain host `services.dnsmasq`,
-    # so the ordering now names the resolver directly — which is what it
-    # always meant. Naming the *container* was already indirection; it
-    # just happened to be correct while the container existed.
-    #
     # `mkMerge`, not a bare assignment: `caTrust.containerOrdering` also
     # sets `after`/`requires` (so the bound trust bundle exists before
     # nspawn wires the mount up), and two plain assignments to the same