module-eval: three duplicate nixosSystem fixtures come from shared.nix

builder.nix's bare, servicesHere and natsHere were exact copies of
shared.bareWithController, swarm-services-switch's swarmServicesHere and
nats-authelia's natsOldPath. The last two move into shared.nix; each file
rebinds them under its local name, so no case changes.

nix/checks.nix

@@ -47,6 +47,7 @@ in
   module-eval-builder = import ./module-eval/builder.nix {
     inherit pkgs self nixosSystem;
     inherit (pkgs) lib;
+    shared = moduleEvalShared;
   };
   module-eval-nats-authelia = import ./module-eval/nats-authelia.nix {
     inherit pkgs self nixosSystem;

nix/module-eval/builder.nix

@@ -7,6 +7,7 @@
   lib,
   self,
   nixosSystem,
+  shared,
 }:
 let
   inherit
@@ -19,11 +20,10 @@ let
         ;
     })
     hive
-    hiveWithController
     runGroup
     ;
 
-  bare = hiveWithController { };
+  bare = shared.bareWithController;
 
   # On the store's host, which mints the builder's store identity.
   withBuilder = hive {
@@ -31,16 +31,13 @@ let
     deploy.builder.enable = true;
   };
 
-  servicesHere = hiveWithController { deploy.allSwarmServices = true; };
+  servicesHere = shared.swarmServicesWithController;
   # Short-circuits on `assertion`, so only a failing one has its message read.
   refusedWithoutIdentity =
     m:
     lib.any (a: !a.assertion && lib.hasInfix "deploy.builder.enable requires" a.message) m.assertions;
 
-  natsHere = hive {
+  natsHere = shared.natsOldPath;
-    swarm.nats.enable = true;
-    swarm.nats.authPackage = pkgs.emptyDirectory;
-  };
 
   autheliaHere = hive {
     deploy.bao.enable = true;

nix/module-eval/nats-authelia.nix

@@ -22,13 +22,9 @@ let
     runGroup
     ;
 
-  # The queue's two old `swarm.nats` paths that still rename, `enable` and
+  # The queue's two old `swarm.nats` paths that still rename; dropping either
-  # `authPackage`, so dropping either shim fails the eval. No store identity,
+  # shim fails the eval. No store identity, which the first case below relies on.
-  # which the first case below relies on.
+  natsOldPath = shared.natsOldPath;
-  natsOldPath = hive {
-    swarm.nats.enable = true;
-    swarm.nats.authPackage = pkgs.emptyDirectory;
-  };
 
   # Seventh split slice, plus slice 10's two authelia packages. Of slice 7's
   # movers only `usersFile` has a rename entry — the other two are `readOnly`,

nix/module-eval/shared.nix

@@ -51,6 +51,17 @@ in
 
   servicesHere = hive { deploy.allSwarmServices = true; };
 
+  # The all-swarm-services switch on the controller's host, the services box
+  # shape that hives elsewhere join.
+  swarmServicesWithController = hiveWithController { deploy.allSwarmServices = true; };
+
+  # The queue's two old `swarm.nats` paths that still rename, `enable` and
+  # `authPackage`, with no store identity.
+  natsOldPath = hive {
+    swarm.nats.enable = true;
+    swarm.nats.authPackage = pkgs.emptyDirectory;
+  };
+
   controllerAlone = hive { deploy.swarm-controller.enable = true; };
 
   matrixNoBaoIdentity = hiveWithController { deploy.matrix.enable = true; };

nix/module-eval/swarm-services-switch.nix

@@ -88,7 +88,7 @@ let
   # The swarm's shared services hosted HERE without the all-local mode — a
   # services box with hives elsewhere, the shape ./host-modules/
   # swarm-required-services.nix documents the switch for.
-  swarmServicesHere = hiveWithController { deploy.allSwarmServices = true; };
+  swarmServicesHere = shared.swarmServicesWithController;
 
   # Same, with the operator opting out of the classifier and the builder,
   # which the switch defaults on and everything else it owns stays on.