swarm builder: the all-swarm-services switch turns it on, like every other swarm service

deploy.builder.enable defaults on under deploy.allSwarmServices (mkDefault),
where the host has the builder's store identity pair, as for the review
classifier. An explicit false still wins.

docs/swarm/services.md

@@ -268,9 +268,11 @@ the container and the threat model are in
 ### Builder
 
 The swarm builder, in a `swarm-builder` container on the host that sets
-`deploy.builder.enable`. It doesn't derive from `allSwarmServices`: it
-evaluates and builds unreviewed config PRs through its host's nix daemon, so
-running one is a decision of its own, as for the CI runner.
+`deploy.builder.enable`. `allSwarmServices` defaults it on wherever the host
+has the builder's store identity, as for the review classifier below: the host
+that runs the store has it. Set `deploy.builder.enable = false` to opt out. It
+evaluates unreviewed config PRs and builds them through its host's nix daemon,
+from a container with its own network namespace.
 
 When an `agent-configs/<agent>` PR opens, reopens or gets a new push,
 swarm-controller queues a `build_agent` job. Jobs run one at a time, and a

docs/trust-boundary/security.md

@@ -133,7 +133,8 @@ checkpoints**, not about sandboxing the agent from its own tools:
   scheduled prompts are operator-only, set at swarm level
   (see [`schedules.md`](../swarm/schedules.md)).
   Before that merge, the swarm builder evaluates an unmerged config PR
-  off-hive, on any host that sets `deploy.builder.enable`: it builds the
+  off-hive, on any host that sets `deploy.builder.enable` (the
+  all-swarm-services switch defaults it on): it builds the
   PR's head with a read-only forge token, in its own netns, as an untrusted
   client of its host's nix daemon (see [`builder.md`](../swarm/builder.md)).