feat(nix): a flake check that actually covers nix

Every other check in nix/checks.nix is a Rust derivation, so a
.nix-only diff moves no hash, the whole set is cache hits, and
`nix flake check` reports green without evaluating what changed.

`checks.module-eval` is one derivation holding a table of cases, each
named by the PROPERTY it defends. Its builder text embeds the evaluated
results, so the derivation's hash is a function of them: a nix change
that flips a property rebuilds the check and fails in the builder,
naming that property.

PROVEN, not assumed — the mechanism was executed before the cases were
written. Same expression with one property true vs false:

  drvPath true  -> 5v11mnbv…-module-eval.drv
  drvPath false -> ivm3dvv8…-module-eval.drv        (differs)
  build false   -> FAILS, stderr names the property

and the table itself was mutation-tested: inverting one case's
expectation gives `FAILED: a hive that has not opted into all-local
runs no swarm controller / module-eval: 1 of 5 properties broke`. A
check that cannot go red on a broken tree is not evidence.

Cases are named by property and never by ticket: a case named after the
ticket that prompted it has that ticket's lifetime; one named after the
property lives as long as the property does.

⚠️ It evaluates, it does not execute. Where the artifact is a command
line, a request or a certificate, a value assertion cannot stand in —
that is written into the file's header, because the gap is exactly what
made two earlier outages evaluable-but-broken.

nix/checks.nix

@@ -1,6 +1,6 @@
 # Flake checks: formatting, the clippy gate, the workspace test run,
-# the nix-options docs eval, and the hivectl CLI-reference freshness
-# check. Imported per system from flake.nix.
+# the nix-options docs eval, the hivectl CLI-reference freshness check,
+# and the module-eval property table. Imported per system from flake.nix.
 {
   pkgs,
   craneLib,
@@ -8,6 +8,7 @@
   self,
   system,
   treefmt-eval,
+  nixosSystem,
 }:
 let
   inherit (rust) cleanSrc cargoArtifacts nativeBuildInputs;
@@ -15,6 +16,16 @@ in
 {
   formatting = treefmt-eval.config.build.check self;
 
+  # The only check here that covers **nix**. Every other one is a Rust
+  # derivation, so a `.nix`-only diff moves no hash and the whole set is
+  # cache hits — green without evaluating what changed. See the file's
+  # header for what belongs in it and what needs something that executes
+  # rather than evaluates.
+  module-eval = import ./module-eval.nix {
+    inherit pkgs self nixosSystem;
+    inherit (pkgs) lib;
+  };
+
   # Clippy via crane's first-class `cargoClippy` builder. Reuses the
   # shared `cargoArtifacts` (deps already built) and runs
   # `cargo clippy --workspace --all-targets` directly.