start the forge and github pollers when their token lands late

Both pollers wait about ten minutes for the agent's token, then exit 0.
Under Restart=on-failure that exit is final, and nothing started them
again, so a token minted or placed after the window left the agent
without notifications until its container restarted.

Add a path unit per poller with PathChanged on the token file(s) the
poller reads, the shape forge-avatar-sync already uses. A path unit
starts its service only when it is not running, so a poller that found
its token is untouched. The github path unit is gated on
github.enable like its service.

Container-side: it ships with the agent's next rebuild, and an agent on
an older rev keeps the old behaviour.

Closes #6179

nix/agent-modules/forge.nix

@@ -181,6 +181,21 @@ in
       };
     };
 
+    # Starts the poller when a token appears after it gave up waiting for one
+    # (the poller waits about ten minutes, then exits 0, which `on-failure`
+    # does not restart). A path unit starts its service only when it is not
+    # running, so it costs nothing while the poller runs. Both files the poller
+    # reads are watched. `PathChanged=` for the reason given on
+    # `forge-avatar-sync` below.
+    systemd.paths.hive-forge-notify = {
+      description = "start hive-forge-notify when the forge token appears";
+      wantedBy = [ "multi-user.target" ];
+      pathConfig.PathChanged = [
+        fetchedTokenFile
+        stateTokenFile
+      ];
+    };
+
     # Path-trigger sibling: re-fires forge-avatar-sync when the fetched
     # forge token (./forge-token.nix) appears or is replaced. On first
     # agent deployment the container can boot before the swarm has minted