module-eval: set the hive-controller option only in tests that need a hive

The shared `hive` fixture turned `deploy.hive-controller.enable` on for
every eval test. It is now off by default; `hiveWithController` turns it
on, and the fixtures whose claims read the hive tier (hive-c0re, the
queue-agent credential, the hive leaf, `deploy.hive-controller.*`, or an
absence that is only meaningful with a hive present) use it.

glue-nats-auth-bao-identity.nix still read the renamed
`services.hyperhive.enable`, which printed the "Obsolete option" trace
six times per CI run. The term is dropped: the pairing is gated on the
queue and the minted PKI, as its sibling glue-nats-bao-identity.nix is.

nix/module-eval/secret-publisher.nix

@@ -18,6 +18,7 @@ let
         ;
     })
     hive
+    hiveWithController
     runGroup
     ;
 
@@ -80,7 +81,7 @@ let
 
   # The store and a service that reads from it, versus the store alone. The
   # pair is what makes the reader's absence arm mean anything.
-  baoWithMatrix = hive {
+  baoWithMatrix = hiveWithController {
     deploy.bao.enable = true;
     deploy.matrix.enable = true;
   };