swarm-archive: grant only once an archive is up; keep logins across a gap in placements

The archive host creates a ready marker in the store and swarm-controller
writes no credentials before it exists, so a swarm without an archive, and a
mixed-version swarm, leave every hive backup a logged no-op. A hive with no
declaration no longer counts as placing nothing: its copies and its agents'
user lines stay. The restic password is pinned by tests across a revoke, a
re-placement and a move.

nix/host-modules/swarm-bao.nix

@@ -546,6 +546,10 @@ let
       capabilities = ["list"]
     }
 
+    path "${credentialMountPath}/data/swarm/services/archive/ready" {
+      capabilities = ["read"]
+    }
+
     path "${credentialMountPath}/metadata/swarm/services/archive/users/+" {
       capabilities = ["delete"]
     }
@@ -1139,6 +1143,12 @@ let
     }
   '';
 
+  createReadStanza = path: ''
+    path "${path}" {
+      capabilities = ["create", "read"]
+    }
+  '';
+
   listStanza = path: ''
     path "${path}" {
       capabilities = ["list"]
@@ -1383,7 +1393,8 @@ let
 
   # The backup archive: the users file is rendered from one leaf per agent, and
   # the prune reads each agent's restic password. Read and list only; the
-  # controller writes both.
+  # controller writes both. It also creates the marker that tells the
+  # controller an archive exists.
   archiveReaders = [
     {
       name = "swarm-archive";
@@ -1391,7 +1402,8 @@ let
       policyText =
         readStanza "${credentialMountPath}/data/swarm/services/archive/users/*"
         + readStanza "${credentialMountPath}/data/swarm/services/archive/restic/*"
-        + listStanza "${credentialMountPath}/metadata/swarm/services/archive/users/";
+        + listStanza "${credentialMountPath}/metadata/swarm/services/archive/users/"
+        + createReadStanza "${credentialMountPath}/data/swarm/services/archive/ready";
     }
   ];