retry a refused shared policy write at controller startup

A refused write of the shared hive policy or the shared agent policy
returned Ok from the startup pass, so only a controller restart tried
again. Both now come back as Unreachable, which the existing 30 s retry
already covers. Per-hive role failures stay warn-and-skip.

The retry rewrites the same policy text; nothing new is minted. No wire
or option change; internal to swarm-controller.

Closes #6087

swarm-controller/src/store.rs

@@ -197,6 +197,8 @@ pub(crate) mod fake {
         unwritable_roles: Vec<String>,
         /// The accessor read fails.
         no_accessor: bool,
+        /// How many more accessor reads fail before one succeeds.
+        accessor_refusals: Mutex<u32>,
         /// Every policy write is refused.
         refuse_policy: bool,
         /// The entity that owns each alias, as `(id, name)`.
@@ -214,6 +216,14 @@ pub(crate) mod fake {
             }
         }
 
+        /// A store whose cert mount accessor cannot be read the first `n` times.
+        pub(crate) fn with_accessor_refused(n: u32) -> Self {
+            Self {
+                accessor_refusals: Mutex::new(n),
+                ..Self::default()
+            }
+        }
+
         /// A store that refuses every policy write.
         pub(crate) fn refusing_policies() -> Self {
             Self {
@@ -340,7 +350,9 @@ pub(crate) mod fake {
 
         async fn auth_mount_accessor(&self, _mount: &str) -> Result<String, Error> {
             self.log("auth_mount_accessor".to_owned());
-            if self.no_accessor {
+            let mut refusals = self.accessor_refusals.lock().expect("not poisoned");
+            if self.no_accessor || *refusals > 0 {
+                *refusals = refusals.saturating_sub(1);
                 return Err(Self::denied());
             }
             Ok("auth_cert_test".to_owned())