docs(swarm-otel): scrapeTargets constrains the target, not the scraper

The option's description claimed declaring an entry from the service's
own module put 'the scraper and the target on the same host by
construction rather than by luck'. It does not. It constrains where the
target is; nothing in it places the collector, and the two enable flags
are co-located by a shared lib.mkDefault rather than by construction.

Split across hosts, a target is silently never scraped — the service's
host declares an entry no local collector reads, the collector's host
never enabled the service. No error surfaces, and no assertion can
catch it: separate hosts are separate evaluations with no shared
context, so the doc telling the truth is the only mechanism there is.

The same paragraph already warned co-location was not a guarantee, four
lines below the sentence claiming it was; a reader arriving for
permission stopped at the permission. This one did.

swarm-nats carries the concrete caveat for its own contribution.

nix/host-modules/swarm-nats.nix

@@ -482,22 +482,27 @@ in
       }
     ];
 
-    # Declared here rather than in the collector's module, which is the
-    # rule the option carries: an entry exists only where the service that
-    # named it runs, so the scraper and the target are on one host by
-    # construction rather than by luck.
+    # Declared here rather than in the collector's module: an entry then
+    # exists only where the service that named it runs. Gated on a
+    # collector, because a target nobody reads asserts a collection that is
+    # not happening.
     #
-    # Gated on the collector, because a target nobody reads is a config
-    # asserting a collection that is not happening. This does NOT make the
-    # queue scrapeable from another host — that would need the endpoint
-    # published under a name with a cert and an audience, and nothing here
-    # should be: both listeners above are deliberately loopback.
+    # ⚠️ KNOWN LIMITATION, and it is SILENT. That rule constrains the
+    # target, not the scraper — nothing places the collector on this host.
+    # `swarm-required-services.nix` derives `nats.enable` and `otel.enable`
+    # from one `lib.mkDefault`, so they are co-located by *default*, and an
+    # operator may split them. Split, NATS is never scraped: this host
+    # declares an entry no local collector reads, the collector's host never
+    # enabled this module. No error, no warning — a healthy exporter and an
+    # empty dashboard.
     #
-    # ⚠️ `swarm.otel`, not `hyperhive.otel` — two collectors one word
-    # apart, and only this one reads `scrapeTargets`. Written in full so
-    # the gate and the option it gates are visibly the same path; gating
-    # the wrong one is not a build error, it is a target that is always
-    # declared or never is.
+    # Not guardable: separate hosts are separate evaluations with no shared
+    # context, so this one cannot see what that one runs. Saying so is the
+    # only mechanism there is.
+    #
+    # ⚠️ `swarm.otel`, not `hyperhive.otel` — two collectors one word apart,
+    # and only this one reads `scrapeTargets`. Written in full so the gate
+    # and the option it gates are visibly the same path.
     services.hyperhive.swarm.otel.scrapeTargets = lib.mkIf config.services.hyperhive.swarm.otel.enable {
       nats = "127.0.0.1:${toString cfg.metricsPort}";
     };