drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

hive-c0re/src/lifecycle/agent_identity.rs

@@ -8,10 +8,9 @@
 //! asked to authenticate in order to obtain the thing it authenticates with:
 //! by the time it runs, its identity is already inside it.
 //!
-//! **A credential and not a bind mount**, the same answer and the same reason
-//! as the queue secret beside it in [`super::host_config`]: the files are
-//! `0600` to `hive-core` and the units that use them run as the unprivileged
-//! agent user, so a bind would deliver a private key that user cannot open.
+//! **A credential and not a bind mount**: the files are `0600` to `hive-core`
+//! and the units that use them run as the unprivileged agent user, so a bind
+//! would deliver a private key that user cannot open.
 //! The container manager reads a `--load-credential` source as root and
 //! re-exposes it under the consuming unit's own `User=`.
 //!
@@ -60,8 +59,7 @@ const SERVER_CA_CREDENTIAL: &str = "hive-agent-bao-server-ca";
 ///
 /// Already-staged files survive a failed collection. A store that is briefly
 /// unreachable then delivers the identity from the last successful read rather
-/// than none at all — the same call as the queue reader's, which leaves its
-/// files alone when the store says nothing.
+/// than none at all.
 pub async fn stage(agent: &str) -> Vec<CredentialMount> {
     let dir = crate::paths::agent_identity_dir(agent);
     match collect(agent, &dir).await {
@@ -246,7 +244,7 @@ mod tests {
 
     /// Half a delivery is worse than none: the container's check would fail
     /// on the missing key and report a login problem instead of a delivery
-    /// one. Same both-or-neither rule the queue credential states.
+    /// one.
     #[test]
     fn a_certificate_without_its_key_forwards_nothing() {
         let dir = tempfile::tempdir().expect("tempdir");