docs/gotchas: drop the env-var/removed-option framing, just state the always-isolated behavior

docs/gotchas.md

@@ -30,9 +30,12 @@ Not `boot.isContainer = true`. Renamed in nixos-25.11+.
 
 …in the `.conf`. The start script's `if HOST_ADDRESS set →
 --network-veth` branch then forces a private netns — silently fatal
-for our web UIs (the bind is invisible from the host). We
-force-clear `HOST_ADDRESS` / `LOCAL_ADDRESS` / `HOST_ADDRESS6` /
-`LOCAL_ADDRESS6` / `HOST_BRIDGE` and set `PRIVATE_NETWORK=0`.
+for our web UIs (the bind is invisible from the host). Every agent
+container runs isolated: `hive-priv`'s `write_nspawn_flags` writes
+`PRIVATE_NETWORK=1` plus a veth pair onto the host bridge, `HOST_ADDRESS`
+set to the bridge gateway IP (so `nixos-container`'s in-container init
+installs a default route before the DHCP lease arrives), rest left for
+DHCP.
 
 ### systemd service PATH ≠ host PATH
 

hive-priv/src/main.rs

@@ -2578,12 +2578,6 @@ fn validate_bind_path(path: &str) -> Result<()> {
     Ok(())
 }
 
-/// Update `/etc/nixos-containers/<container>.conf`: strips network-isolation
-/// vars (`PRIVATE_NETWORK`, `HOST_ADDRESS*`, `LOCAL_ADDRESS*`, `HOST_BRIDGE`,
-/// Update `/etc/nixos-containers/<container>.conf`: strip old network vars,
-/// write network isolation settings, then append `EXTRA_NSPAWN_FLAGS`.
-/// When `isolation` is `Some`, writes `PRIVATE_NETWORK=1` + veth wiring;
-/// when `None`, writes `PRIVATE_NETWORK=0`.
 /// `--tmpfs=<mount>/.git` for every bound git repo, hiding its metadata
 /// from inside the container.
 ///
@@ -2613,6 +2607,12 @@ fn git_overlay_flags(binds: &[BindMount]) -> Vec<String> {
         .collect()
 }
 
+/// Update `/etc/nixos-containers/<container>.conf`: strip old network vars
+/// (`PRIVATE_NETWORK`, `HOST_ADDRESS*`, `LOCAL_ADDRESS*`, `HOST_BRIDGE`),
+/// write the current network-isolation settings, then append
+/// `EXTRA_NSPAWN_FLAGS`. When `isolation` is `Some`, writes
+/// `PRIVATE_NETWORK=1` + veth wiring; when `None`, writes
+/// `PRIVATE_NETWORK=0`.
 fn write_nspawn_flags(
     container: &str,
     binds: &[BindMount],