nix: finish the current-behaviour comment sweep in touched files

Rewrite the remaining narration in files the previous commit touched:
"moved"/"sat"/"was REMOVED"/"old default" comments in swarm-bao,
swarm-otel, glue-bao-tls, nats-authelia, swarm-controller, swarm-ui,
swarm-otel-service, swarm-authelia-service, the deploy.nix rename table,
hive-ci, hive-forge/service, hive-tls, hyperhive, swarm-nats, swarm.nix
and a few module-eval fixtures, so each says where a thing is or why it
is so now.

Revert the comment edits inside shell script strings in hive-tls,
swarm-nats and the forge token mint to their previous text, so those
generated units are unchanged. The only unit still changing is
swarm-bao-pki (two comment lines in its script). Refs #3902

nix/host-modules/hive-ci.nix

@@ -197,8 +197,8 @@ in
     ];
 
     # Tell hive-c0re that CI is enabled so its startup sweep registers the
-    # runner. Registration moved OFF the container's boot-critical path into
-    # hive-c0re (`forge/ci_runner.rs`): it validates the persisted `.runner`
+    # runner. Registration is OFF the container's boot-critical path:
+    # hive-c0re (`forge/ci_runner.rs`) validates the persisted `.runner`
     # against the forge and, when absent/stale, mints a registration token and
     # hands it to hive-priv to write `/run/hive-ci/runner-token` + restart the
     # runner. The forge admin token stays in hive-c0re; only the registration