nix: finish the current-behaviour comment sweep in touched files

Rewrite the remaining narration in files the previous commit touched:
"moved"/"sat"/"was REMOVED"/"old default" comments in swarm-bao,
swarm-otel, glue-bao-tls, nats-authelia, swarm-controller, swarm-ui,
swarm-otel-service, swarm-authelia-service, the deploy.nix rename table,
hive-ci, hive-forge/service, hive-tls, hyperhive, swarm-nats, swarm.nix
and a few module-eval fixtures, so each says where a thing is or why it
is so now.

Revert the comment edits inside shell script strings in hive-tls,
swarm-nats and the forge token mint to their previous text, so those
generated units are unchanged. The only unit still changing is
swarm-bao-pki (two comment lines in its script). Refs #3902

nix/host-modules/swarm-otel.nix

@@ -555,8 +555,8 @@ in
         # that runs it without a leaf, because a Grafana with no SSO has no way
         # in at all, while a collector with none still receives telemetry. So
         # this fires only where the host already reads the store and is missing
-        # this one pair — which before the four-way split rendered the unit off
-        # `clientCertFile`, and now silently does not.
+        # this one pair: the unit is rendered off the collector's own leaf, so
+        # without it the unit would silently not render.
         assertion = !hiveReaderIdentity || haveClientIdentity;
         message = ''
           This host reads the swarm secret store (services.hyperhive.deploy.bao.clientCertFile
@@ -586,10 +586,10 @@ in
           from that CA out of band and named here — see docs/swarm/secrets.md.
         '';
       }
-      # ⚠️ An assertion that this collector has "somewhere to send" was REMOVED
-      # rather than relaxed: it read the store's *per-host* enable, so it
-      # rejected at eval the very deployment the stores are reached by domain
-      # for — a collector on its own host never built.
+      # ⚠️ There is deliberately no assertion that this collector has
+      # "somewhere to send": it would read the store's *per-host* enable, and
+      # so reject at eval the very deployment the stores are reached by domain
+      # for — a collector on its own host would never build.
       {
         # Whether there is a journal on disk to collect from.
         # A `bindMounts` entry never creates its `hostPath`, and unlike