chore(nix): replace tracker tags with prose in nix comments

Part of the tracker-tag cleanup: the hive convention is prose, not
issue-tracker tags, in code. Reword the 21 tags in the nix tree
(flake.nix + the hive-c0re/ci/gateway/network modules) to describe
the thing they pointed at, preserving the context without the tag.

Comment-only — no eval or logic change. Validated with nix fmt
(no reformatting) and nix flake check --no-build (all checks
evaluate clean); the full build check was skipped locally because
the shared remote builder is degraded, so CI will exercise the
build derivations once the runner recovers.

nix/modules/hive-ci.nix

@@ -118,7 +118,7 @@ let
       # attempt for the full 60s loop, then exits with a misleading
       # "core token absent or forge unreachable" — masking the real cause.
       # Fail fast + loudly on 401/403 so the failure mode is legible and
-      # the operator/hive-c0re knows to re-mint forge-core-token (#1475).
+      # the operator/hive-c0re knows to re-mint forge-core-token.
       RESP=$(${pkgs.curl}/bin/curl -s -w $'\n%{http_code}' \
         "$FORGE_URL/api/v1/admin/runners/registration-token" \
         -H "Authorization: token $CORE_TOKEN" || printf '\n000')
@@ -287,9 +287,9 @@ in
       # `nixos-container@…`. The earlier `nixos-container@hive-ci.service`
       # matched no real unit, so before/wantedBy/partOf were silent
       # no-ops — the partOf never bound, the oneshot stayed
-      # `active (exited)`, and the token was never refreshed on restart
-      # (a contributor to #1475). Confirmed against the live
-      # `container@hive-matrix.service` unit during the #1465 incident.
+      # `active (exited)`, and the token was never refreshed on restart.
+      # Confirmed against the live `container@hive-matrix.service` unit
+      # during the matrix-outage incident.
       partOf = [ "container@hive-ci.service" ];
       serviceConfig = {
         Type = "oneshot";