nix: split module-eval into per-subsystem checks

The single module-eval derivation forced ~62 full nixosSystem
fixtures live at once to compute its cases list: 10.6GB peak RSS /
5m25s to evaluate, by far the dominant cost in nix flake check.
Splits it into 21 independent checks.module-eval-* derivations
(1-7 fixtures each) sharing builders/helpers via module-eval/lib.nix,
so no single derivation needs more than a handful of fixtures live
at once. A few cases spanning two clusters carry a small duplicated
fixture rather than threading shared state through lib.nix.

nix/module-eval/agent-icon.nix

@@ -0,0 +1,49 @@
+# `checks.module-eval-agent-icon` — see ./lib.nix for the shared
+# rationale (why this suite exists, naming convention, "evaluates
+# not executes").
+{
+  pkgs,
+  lib,
+  self,
+  nixosSystem,
+}:
+let
+  inherit
+    (import ./lib.nix {
+      inherit
+        pkgs
+        lib
+        self
+        nixosSystem
+        ;
+    })
+    agent
+    agentWith
+    runGroup
+    ;
+
+  # An agent with an icon and no forge. Both halves of the avatar sync — the
+  # `.path` watcher and the oneshot it triggers — hang off the icon, but only
+  # the service can do anything with a forge URL, so the icon alone is the one
+  # input that can render half the feature. `pkgs.emptyFile` rather than a real
+  # SVG: the icon is only ever a gate here, and nothing this case reads
+  # rasterizes it.
+  agentIconNoForge = agentWith { services.hyperhive.agent.icon = pkgs.emptyFile; };
+  cases = [
+    {
+      # The absence class, and a gate asymmetry nothing else can see. A `.path`
+      # unit is `wantedBy = multi-user.target` and names a `Unit=` by
+      # convention rather than by reference, so one gated more loosely than the
+      # service it triggers evaluates clean, deploys clean, and then fails to
+      # activate the first time the watched file is written. `forge.url`'s own
+      # option doc already promises the avatar-sync units are "not generated at
+      # all" without a forge — this is the case that makes that sentence true
+      # of the watcher and not only of the oneshot.
+      name = "an agent with an icon and no forge renders neither avatar-sync unit";
+      ok =
+        !(agentIconNoForge.systemd.paths ? forge-avatar-sync)
+        && !(agentIconNoForge.systemd.services ? forge-avatar-sync);
+    }
+  ];
+in
+runGroup "agent-icon" cases