give the secrets unit a private tmp for its prefetched secrets

nix/host-modules/swarm-authelia.nix

@@ -1215,6 +1215,10 @@ in
               storeRetry.serviceConfig
               // {
                 LoadCredential = lib.attrNames storeFiles;
+                # `store_prefetch` keeps secret values in files under the
+                # temporary directory. A private one is removed by systemd when
+                # the unit stops, which a kill at the start timeout is too.
+                PrivateTmp = true;
                 # Bounds one run, and so the container's boot when the store
                 # accepts a connection and never answers: this unit is in the
                 # boot wait of a container with a one-minute start limit.

nix/module-eval/secret-publisher.nix

@@ -558,6 +558,8 @@ let
           phases = lib.filter (lib.hasPrefix "phase_done ") lines;
         in
         (unit secretPublisherHere).serviceConfig.TimeoutStartSec == 30
+        && (unit secretPublisherHere).serviceConfig.PrivateTmp or false
+        && !((unit secretPublisherNoIdentity).serviceConfig ? PrivateTmp)
         && lib.length calls == 1
         && lib.length clientLeaves >= 4
         && lib.all hasLeaf clientLeaves