nix: split module-eval into per-subsystem checks

The single module-eval derivation forced ~62 full nixosSystem
fixtures live at once to compute its cases list: 10.6GB peak RSS /
5m25s to evaluate, by far the dominant cost in nix flake check.
Splits it into 21 independent checks.module-eval-* derivations
(1-7 fixtures each) sharing builders/helpers via module-eval/lib.nix,
so no single derivation needs more than a handful of fixtures live
at once. A few cases spanning two clusters carry a small duplicated
fixture rather than threading shared state through lib.nix.

nix/module-eval/agent-matrix.nix

@@ -0,0 +1,107 @@
+# `checks.module-eval-agent-matrix` — see ./lib.nix for the shared
+# rationale (why this suite exists, naming convention, "evaluates
+# not executes").
+{
+  pkgs,
+  lib,
+  self,
+  nixosSystem,
+}:
+let
+  inherit
+    (import ./lib.nix {
+      inherit
+        pkgs
+        lib
+        self
+        nixosSystem
+        ;
+    })
+    agent
+    runGroup
+    ;
+
+  # Matrix's enable signal, which is the account set itself — there is no
+  # `matrix.enable` option left to read. Three arms, because the property has
+  # three distinct shapes and only one of them is the common case:
+  #
+  # - a homeserver URL, which is what the module turns into a `main` account;
+  # - neither URL nor operator account, the state that replaced
+  #   `matrix.enable = false`. ⚠️ **This is the arm that matters.** `main` is
+  #   declared by the module itself, so "any account declared" would be
+  #   trivially true — and matrix would render for every agent in every hive —
+  #   the moment that declaration stops being gated on the URL. Nothing else in
+  #   this suite would notice;
+  # - an operator account carrying its own homeserver and no hive one, which is
+  #   matrix on with no `main` at all.
+  agentMatrix = agent { matrix.url = "https://chat.t.local"; };
+
+  agentNoMatrix = agent { };
+
+  agentMatrixExternalOnly = agent {
+    matrixAccounts.ccc = {
+      tokenFile = "/agents/a1/state/matrix-token-ccc";
+      sessionDir = "/agents/a1/state/matrix-sdk-state-ccc";
+      homeserver = "https://matrix.example.invalid";
+    };
+  };
+  cases = [
+    {
+      # A homeserver URL is the whole input: from it the module derives the
+      # hive-internal `main` account, and from a non-empty account set the three
+      # things that used to hang off `matrix.enable`.
+      name = "an agent with a homeserver gets a main account and the matrix units";
+      ok =
+        let
+          a = agentMatrix.services.hyperhive.agent.matrixAccounts;
+        in
+        lib.attrNames a == [ "main" ]
+        && a.main.tokenFile == "/agents/a1/state/matrix-token"
+        && a.main.homeserver == "https://chat.t.local"
+        && agentMatrix.systemd.services ? hive-matrix-daemon
+        && agentMatrix.systemd.paths ? hive-matrix-daemon
+        && agentMatrix.services.hyperhive.agent.extraMcpServers ? matrix;
+    }
+    {
+      # The absence arm, and the reason the enable signal is not vacuous. An
+      # agent the hive gave no homeserver, whose operator declared nothing, must
+      # come out with an EMPTY account set — not a `main` that can never log in
+      # — and therefore with none of the three. Assert the emptiness itself and
+      # not just the units: it is the account set that is load-bearing now, and
+      # a `main` sneaking back in is the regression this case exists to name.
+      name = "an agent with no homeserver and no declared account gets no matrix at all";
+      ok =
+        agentNoMatrix.services.hyperhive.agent.matrixAccounts == { }
+        && !(agentNoMatrix.systemd.services ? hive-matrix-daemon)
+        && !(agentNoMatrix.systemd.paths ? hive-matrix-daemon)
+        && !(agentNoMatrix.services.hyperhive.agent.extraMcpServers ? matrix);
+    }
+    {
+      # Matrix without a hive homeserver: one operator account, its own
+      # homeserver, no `main`. Under the deleted `matrix.enable` this config was
+      # an assertion failure ("extras require enable") even though every account
+      # in it was complete; the account set being the signal is what makes it
+      # expressible, and the serialized env var is where that has to show up.
+      name = "an external-only account enables matrix with no main entry";
+      ok =
+        let
+          accts = agentMatrixExternalOnly.services.hyperhive.agent.matrixAccounts;
+          env = agentMatrixExternalOnly.systemd.services.hive-matrix-daemon.environment;
+        in
+        lib.attrNames accts == [ "ccc" ]
+        && !(accts ? main)
+        &&
+          builtins.fromJSON env.HIVE_MATRIX_ACCOUNTS == [
+            {
+              name = "ccc";
+              token_file = "/agents/a1/state/matrix-token-ccc";
+              state_dir = "/agents/a1/state/matrix-sdk-state-ccc";
+              homeserver = "https://matrix.example.invalid";
+            }
+          ]
+        # No hive homeserver, so nothing may claim one.
+        && !(env ? HIVE_MATRIX_URL);
+    }
+  ];
+in
+runGroup "agent-matrix" cases