module-eval: set the hive-controller option only in tests that need a hive

The shared `hive` fixture turned `deploy.hive-controller.enable` on for
every eval test. It is now off by default; `hiveWithController` turns it
on, and the fixtures whose claims read the hive tier (hive-c0re, the
queue-agent credential, the hive leaf, `deploy.hive-controller.*`, or an
absence that is only meaningful with a hive present) use it.

glue-nats-auth-bao-identity.nix still read the renamed
`services.hyperhive.enable`, which printed the "Obsolete option" trace
six times per CI run. The term is dropped: the pairing is gated on the
queue and the minted PKI, as its sibling glue-nats-bao-identity.nix is.

nix/module-eval/matrix-core.nix

@@ -18,6 +18,7 @@ let
         ;
     })
     hive
+    hiveWithController
     runGroup
     ;
 
@@ -30,11 +31,11 @@ let
 
   # The same hive with the identity taken away, which separates "a homeserver
   # is deployed" from "this host can authenticate to the store".
-  matrixNoBaoIdentity = hive { deploy.matrix.enable = true; };
+  matrixNoBaoIdentity = hiveWithController { deploy.matrix.enable = true; };
 
   # A hive host that does not run the homeserver: its hive-c0re reaches the
   # homeserver across the network.
-  matrixElsewhere = hive { };
+  matrixElsewhere = hiveWithController { };
   cases = [
     {
       # Absence arm, and what makes the one above able to fail: with no leaf