move install_crypto_provider to swarm-secret-client

The rustls provider install is process setup every swarm binary runs, and
swarm-secret-client depends on no other swarm crate, so a binary that only
needs the provider and the store no longer links the queue client.

- swarm-secret-client/src/lib.rs, Cargo.toml: the function, its test, a
  `//!` line on why it lives there, and the rustls dependency; rustls
  `ring` as a dev-dependency feature, so the test builds both providers as
  the binaries do and fails if the install is dropped.
- swarm-queue-client/src/lib.rs, Cargo.toml: function and test removed;
  `connect()` calls the secret client's; rustls dropped (no other use),
  swarm-secret-client added.
- swarm-metrics-auth/Cargo.toml: drop swarm-queue-client, whose only use
  was the provider; the binary no longer links async-nats.
- swarm-logs-auth, swarm-logs, swarm-metrics, swarm-ci-metrics Cargo.toml:
  the dep comment no longer names the provider (they keep the dep for
  agent_token / the OIDC mint).
- Cargo.toml: the rustls comment names the provider's new home.
- 14 call sites (hive-agent, hive-c0re, hive-subagent-mcp x2,
  swarm-builder, swarm-ci-metrics, swarm-claude-login, swarm-controller,
  swarm-logs-auth, swarm-logs, swarm-metrics-auth, swarm-metrics,
  swarm-nats-auth, swarm-review-classifier): one-line path change.
- Cargo.lock: the dependency edges above.

Cargo.lock

@@ -4984,7 +4984,6 @@ dependencies = [
  "clap",
  "serde",
  "subtle",
- "swarm-queue-client",
  "swarm-secret-client",
  "tokio",
  "tracing",
@@ -5026,10 +5025,10 @@ dependencies = [
  "futures-util",
  "hive-sh4re",
  "reqwest",
- "rustls",
  "serde",
  "serde_json",
  "strum",
+ "swarm-secret-client",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -5066,6 +5065,7 @@ dependencies = [
  "reqwest",
  "rustify",
  "rustify_derive",
+ "rustls",
  "serde",
  "serde_json",
  "strum",

Cargo.toml

@@ -256,7 +256,7 @@ async-nats = { version = "0.50", default-features = false, features = [
   "nkeys",
   "ring",
 ] }
-# Named only to install the process-wide provider (`swarm-queue-client`'s
+# Named only to install the process-wide provider (`swarm-secret-client`'s
 # `install_crypto_provider`). `aws-lc-rs` is the provider reqwest already
 # falls back to, so installing it leaves every HTTPS client unchanged.
 rustls = { version = "0.23", default-features = false, features = [

hive-agent/src/main.rs

@@ -121,7 +121,7 @@ struct Cli {
 #[tokio::main]
 async fn main() -> Result<()> {
     hive_log::init();
-    swarm_queue_client::install_crypto_provider();
+    swarm_secret_client::install_crypto_provider();
 
     let cli = Cli::parse();
     serve_main::<AgentSurface>(&cli.socket, cli.poll_ms).await

hive-c0re/src/main.rs

@@ -129,7 +129,7 @@ enum Cmd {
 #[tokio::main]
 async fn main() -> Result<()> {
     hive_log::init();
-    swarm_queue_client::install_crypto_provider();
+    swarm_secret_client::install_crypto_provider();
 
     let cli = Cli::parse();
     match cli.cmd {

hive-subagent-mcp/src/swarm_models.rs

@@ -106,7 +106,7 @@ impl Reader {
                 return None;
             }
         };
-        swarm_queue_client::install_crypto_provider();
+        swarm_secret_client::install_crypto_provider();
         let agent = target.agent.clone();
         let client = Arc::new(OnceLock::new());
         tokio::spawn(connect_until_up(Arc::new(target), Arc::clone(&client)));

hive-subagent-mcp/src/swarm_term.rs

@@ -111,7 +111,7 @@ impl Publisher {
                 return None;
             }
         };
-        swarm_queue_client::install_crypto_provider();
+        swarm_secret_client::install_crypto_provider();
         tracing::info!(
             url = %target.url,
             stream = %subagent_term::stream_name(&target.agent),

swarm-builder/src/main.rs

@@ -57,7 +57,7 @@ const MAX_SLOT_WAIT: Duration = REPLY_DEADLINE
 #[tokio::main]
 async fn main() -> Result<()> {
     hive_log::init();
-    swarm_queue_client::install_crypto_provider();
+    swarm_secret_client::install_crypto_provider();
     let var = |name: &str| {
         let full = format!("{PREFIX}_{name}");
         std::env::var(&full).with_context(|| format!("{full} is unset"))

swarm-ci-metrics/Cargo.toml

@@ -17,7 +17,7 @@ hive-log.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
-# The OIDC client-credentials mint, and the rustls provider.
+# The OIDC client-credentials mint.
 swarm-queue-client.workspace = true
 # The forge token and client secret paths, and the store login.
 swarm-secret-client.workspace = true

swarm-ci-metrics/src/main.rs

@@ -53,7 +53,7 @@ struct Config {
 #[tokio::main]
 async fn main() -> Result<()> {
     hive_log::init();
-    swarm_queue_client::install_crypto_provider();
+    swarm_secret_client::install_crypto_provider();
     let var = |name: &str| {
         let full = format!("{PREFIX}_{name}");
         std::env::var(&full).with_context(|| format!("{full} is unset"))

swarm-claude-login/src/main.rs

@@ -51,7 +51,7 @@ impl login::CredentialSink for AgentLeaf {
 #[tokio::main]
 async fn main() -> Result<()> {
     hive_log::init();
-    swarm_queue_client::install_crypto_provider();
+    swarm_secret_client::install_crypto_provider();
     let var = |name: &str| {
         let full = format!("{PREFIX}_{name}");
         std::env::var(&full).with_context(|| format!("{full} is unset"))

swarm-controller/src/main.rs

@@ -3475,7 +3475,7 @@ async fn start_forge(
 #[tokio::main]
 async fn main() -> Result<()> {
     hive_log::init();
-    swarm_queue_client::install_crypto_provider();
+    swarm_secret_client::install_crypto_provider();
 
     let path = socket_path();
 

swarm-logs-auth/Cargo.toml

@@ -14,7 +14,7 @@ clap.workspace = true
 # The verdict cache's key: a digest of the bearer, never the bearer.
 sha2.workspace = true
 swarm-agent-verify.workspace = true
-# The agent-token spelling, and the rustls provider the store client needs.
+# The agent-token spelling.
 swarm-queue-client.workspace = true
 swarm-secret-client.workspace = true
 tokio.workspace = true

swarm-logs-auth/src/main.rs

@@ -114,7 +114,7 @@ async fn handle(
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
-    swarm_queue_client::install_crypto_provider();
+    swarm_secret_client::install_crypto_provider();
     tracing_subscriber::fmt()
         .with_env_filter(
             tracing_subscriber::EnvFilter::try_from_default_env()

swarm-logs/Cargo.toml

@@ -12,8 +12,7 @@ path = "src/main.rs"
 anyhow.workspace = true
 clap.workspace = true
 clap-markdown = "0.1"
-# The agent-token spelling the gateway's responder parses, and the rustls
-# provider the store client needs.
+# The agent-token spelling the gateway's responder parses.
 swarm-queue-client.workspace = true
 # The read of this agent's own queue secret.
 swarm-secret-client.workspace = true

swarm-logs/src/main.rs

@@ -85,7 +85,7 @@ fn main() -> Result<()> {
             // keep working on a machine that has no log store wired up at
             // all — `markdown-docs` in particular runs in a nix check, where
             // no credential exists and none should.
-            swarm_queue_client::install_crypto_provider();
+            swarm_secret_client::install_crypto_provider();
             let cfg = auth::Config::from_env()?;
             let stdout = std::io::stdout();
             query::run(&cfg, &logsql, limit, format, &mut stdout.lock())

swarm-metrics-auth/Cargo.toml

@@ -14,8 +14,6 @@ clap.workspace = true
 serde.workspace = true
 # Comparing the presented bearer with the stored one.
 subtle.workspace = true
-# Only for the rustls provider the store client needs.
-swarm-queue-client.workspace = true
 swarm-secret-client.workspace = true
 tokio.workspace = true
 tracing.workspace = true

swarm-metrics-auth/src/main.rs

@@ -190,7 +190,7 @@ async fn handle(State(responder): State<Arc<Responder<Store>>>, headers: HeaderM
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
-    swarm_queue_client::install_crypto_provider();
+    swarm_secret_client::install_crypto_provider();
     tracing_subscriber::fmt()
         .with_env_filter(
             tracing_subscriber::EnvFilter::try_from_default_env()

swarm-metrics/Cargo.toml

@@ -12,8 +12,7 @@ path = "src/main.rs"
 anyhow.workspace = true
 clap.workspace = true
 clap-markdown = "0.1"
-# The agent-token spelling the gateway's responder parses, and the rustls
-# provider the store client needs.
+# The agent-token spelling the gateway's responder parses.
 swarm-queue-client.workspace = true
 # The read of this agent's own queue secret.
 swarm-secret-client.workspace = true

swarm-metrics/src/main.rs

@@ -169,7 +169,7 @@ fn main() -> Result<()> {
     };
     // Config read only for a store verb: `markdown-docs` runs in a nix check,
     // where no credential exists.
-    swarm_queue_client::install_crypto_provider();
+    swarm_secret_client::install_crypto_provider();
     let cfg = auth::Config::from_env()?;
     let stdout = std::io::stdout();
     query::run(&cfg, &request, &mut stdout.lock())

swarm-nats-auth/src/main.rs

@@ -192,7 +192,7 @@ struct Args {
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
-    swarm_queue_client::install_crypto_provider();
+    swarm_secret_client::install_crypto_provider();
     tracing_subscriber::fmt()
         .with_env_filter(
             tracing_subscriber::EnvFilter::try_from_default_env()