chore(nix): replace tracker tags with prose in nix comments

Part of the tracker-tag cleanup: the hive convention is prose, not
issue-tracker tags, in code. Reword the 21 tags in the nix tree
(flake.nix + the hive-c0re/ci/gateway/network modules) to describe
the thing they pointed at, preserving the context without the tag.

Comment-only — no eval or logic change. Validated with nix fmt
(no reformatting) and nix flake check --no-build (all checks
evaluate clean); the full build check was skipped locally because
the shared remote builder is degraded, so CI will exercise the
build derivations once the runner recovers.

nix/modules/hive-c0re.nix

@@ -458,7 +458,7 @@ in
         Pre-fetch the per-container system closures (agent-base +
         manager toplevels) into the host's /nix/store as part of this
         host's NixOS build, instead of letting the first agent spawn
-        do all the work. Closes #97.
+        do all the work.
 
         Enabling this adds roughly the full nixpkgs runtime closure +
         claude-code + the harness binary to your system closure size
@@ -612,8 +612,8 @@ in
       pkgs.git
     ];
 
-    # Pull the per-container toplevels into the host system closure
-    # (#97). `system.extraDependencies` adds paths to the system build
+    # Pull the per-container toplevels into the host system closure.
+    # `system.extraDependencies` adds paths to the system build
     # without referencing them at runtime — nixos-rebuild fetches /
     # builds them, they end up in /nix/store, and the first
     # nixos-container update + start for an agent has nothing left to

nix/modules/hive-ci.nix

@@ -118,7 +118,7 @@ let
       # attempt for the full 60s loop, then exits with a misleading
       # "core token absent or forge unreachable" — masking the real cause.
       # Fail fast + loudly on 401/403 so the failure mode is legible and
-      # the operator/hive-c0re knows to re-mint forge-core-token (#1475).
+      # the operator/hive-c0re knows to re-mint forge-core-token.
       RESP=$(${pkgs.curl}/bin/curl -s -w $'\n%{http_code}' \
         "$FORGE_URL/api/v1/admin/runners/registration-token" \
         -H "Authorization: token $CORE_TOKEN" || printf '\n000')
@@ -287,9 +287,9 @@ in
       # `nixos-container@…`. The earlier `nixos-container@hive-ci.service`
       # matched no real unit, so before/wantedBy/partOf were silent
       # no-ops — the partOf never bound, the oneshot stayed
-      # `active (exited)`, and the token was never refreshed on restart
-      # (a contributor to #1475). Confirmed against the live
-      # `container@hive-matrix.service` unit during the #1465 incident.
+      # `active (exited)`, and the token was never refreshed on restart.
+      # Confirmed against the live `container@hive-matrix.service` unit
+      # during the matrix-outage incident.
       partOf = [ "container@hive-ci.service" ];
       serviceConfig = {
         Type = "oneshot";

nix/modules/hive-gateway.nix

@@ -973,8 +973,8 @@ in
               # Hive authoritative records — answer queries for the
               # hive domain + its sub-domains with the bridge IP
               # (where nginx is reachable from container netns once
-              # #14 lands; today it's the host loopback alias and
-              # works in either shape).
+              # per-agent netns isolation lands; today it's the host
+              # loopback alias and works in either shape).
               #
               # The forge / matrix entries are redundant in the
               # common case where `forge.domain` /

nix/modules/hive-network.nix

@@ -97,8 +97,8 @@ in
       default = false;
       example = true;
       description = ''
-        Flip agent containers from shared host netns to private netns
-        (#14). When true, each agent container gets a dedicated veth
+        Flip agent containers from shared host netns to private netns.
+        When true, each agent container gets a dedicated veth
         pair attached to `bridgeName` and a deterministic IP from
         the bridge subnet. The bridge (already up when `enable = true`)
         becomes the sole routed path between the host and agent