report the real error when the granter role's bootstrap step fails, and retry on a standby store

nix/host-modules/swarm-bao.nix

@@ -324,6 +324,17 @@ let
     setupSteps = granterSetupSteps;
   };
 
+  # The bootstrap token's first use, in `swarm-bao-granter-role`.
+  bootstrapAuthList = import ./lib/bootstrap-auth-list.nix {
+    inherit lib baoStoreUp;
+    inherit (baoDeploy)
+      bootstrapTokenFile
+      granterClientCertFile
+      granterClientKeyFile
+      ;
+    setupSteps = granterSetupSteps;
+  };
+
   # The granter's certificate for the granting units. The `baoCli` wrapper
   # only defaults these, so the unit's environment wins.
   granterEnv = {
@@ -3374,6 +3385,7 @@ in
         path = [
           baoCli
           pkgs.coreutils
+          pkgs.gnugrep
         ];
         # Named but not placed is a legitimate state: all-local supplies the
         # path as a default and the operator drops the file there after
@@ -3426,34 +3438,9 @@ in
           # that already exists, and recognising that would tie a rebuild
           # to an error string we have never seen this store emit.
           #
-          # The token's first use, and the bootstrap policy grants this read,
-          # so a refusal from a store that is up is the token's: expired,
-          # revoked, or minted without that policy.
-          if ! mounted="$(bao auth list -format=json 2>"$err")"; then
-            if ${baoStoreUp}; then
-              # A dead token beside a working granter is the steady state of
-              # a host that finished bootstrap and kept the file. The
-              # granter's own login is the proof. A fresh token still takes
-              # the full path below, since the granter cannot read back its
-              # own policy to compare it. The refused token is dead,
-              # so it is deleted here and the unit does not start again.
-              if BAO_CLIENT_CERT=${lib.escapeShellArg baoDeploy.granterClientCertFile} \
-                BAO_CLIENT_KEY=${lib.escapeShellArg baoDeploy.granterClientKeyFile} \
-                bao login -method=cert -token-only >/dev/null 2>&1; then
-                echo "granter role already in place; bootstrap token not needed"
-                rm -f ${lib.escapeShellArg baoDeploy.bootstrapTokenFile}
-                exit 0
-              fi
-              echo ${lib.escapeShellArg "the store is unsealed but refused the bootstrap token in ${baoDeploy.bootstrapTokenFile}: it has expired, been revoked, or does not carry the bao-bootstrap policy."} >&2
-              echo "one-time step, as root on this host (docs/getting-started/setup.md):" >&2
-              ${lib.concatMapStringsSep "\n" (l: "echo ${lib.escapeShellArg "  ${l}"} >&2") granterSetupSteps}
-              cat "$err" >&2
-              exit 4
-            fi
-            echo "the store is sealed or unreachable; retrying." >&2
-            cat "$err" >&2
-            exit 1
-          fi
+          # The token's first use; ./lib/bootstrap-auth-list.nix says which
+          # failures are the token's.
+          ${bootstrapAuthList}
           case "$mounted" in
             *'"cert/"'*) ;;
             *) bao auth enable cert ;;