nix: split statusPublish and the otel secret into deploy.*

Slices 8 and 9 of the swarm/deploy split, and the last two.

statusPublish had three coordinates under one namespace. Two of them
are this machine's — where the queue listens *as seen from here*, and
where its client secret sits on this disk — so they move to
`deploy.hive-controller.statusPublish.*`, the namespace of the daemon
that is their only reader. `tokenEndpoint` is the swarm's one address,
so it stays. That leaves `swarm.statusPublish` holding a single option:
a legitimate split, not a botched move.

The all-or-nothing assertion now spans both namespaces. It is repointed
in both its condition and its message, and the message spells all three
paths in full so an operator is never told to set two options under a
path that only has one. `environment.nix`'s guard and the value beside
it likewise read different namespaces on purpose.

The collector's secret moves the same way, for the same reason, to
`deploy.swarm-otel.*` — `enable` already lives there. That also retires
one of the eight cross-namespace assignments tracked in #4048: the
delivery unit set a `swarm.*` value under a `deploy.*` gate, and now
sets a `deploy.*` value under one.

module-eval gets a fixture per slice. `otelRemoteAuthelia` already set
the collector secret through its pre-rename path, so it becomes slice
9's old-path case as it stands — left spelled that way deliberately,
with a comment, so it is not read later as a missed site.

That fixture also turned out to be describing an impossible hive: it
said authelia lives elsewhere without saying where, so the
authenticator interpolated a null `swarm.authelia.url` into its
`token_url`. Nothing to do with the rename, and invisible to the
existing case over the same fixture, which reads `? auth` and `elem` —
both stop at names and never force the extension's value. Given the
address a remote-IdP deployment has.

Verified: 49 -> 51 properties, all holding.

nix/module-eval.nix

@@ -159,6 +159,18 @@ let
     swarm.grafana.plugins = [ ];
   };
 
+  # The first slice to leave options on BOTH sides of the split, so the
+  # fixture sets all three of them through the paths an existing config uses:
+  # the two movers via their rename entries, `tokenEndpoint` via the path it
+  # kept. That is also what the all-or-nothing assertion wants, so this hive
+  # is a valid one rather than one that only evaluates because nothing forced
+  # the assertion.
+  statusPublishOldPath = hive {
+    swarm.statusPublish.natsUrl = "nats://10.0.0.9:4222";
+    swarm.statusPublish.tokenEndpoint = "https://auth.example.invalid/api/oidc/token";
+    swarm.statusPublish.clientSecretFile = "/run/secrets/status-client.secret";
+  };
+
   baoPkcs11 = hive {
     deploy.bao.enable = true;
     deploy.bao.seal = "pkcs11";
@@ -249,9 +261,19 @@ let
   # authelia somewhere else, the credential delivered by hand. Whether this
   # collector authenticates must follow the credential, never another
   # service's placement.
+  #
+  # The `swarm.otel.clientSecretFile` below is the PRE-RENAME path. It predates
+  # the split and is deliberately left spelled that way: it makes this fixture
+  # the old-path case for that option too, so dropping its rename entry fails
+  # the eval here rather than only in a real operator's config.
   otelRemoteAuthelia = hive {
     deploy.swarm-otel.enable = true;
     deploy.authelia.enable = false;
+    # Where that elsewhere IS. Running no IdP does not mean knowing no IdP:
+    # the authenticator this fixture exists to render puts this address in its
+    # `token_url`, so a hive with a secret and no URL has a credential it can
+    # present nowhere.
+    swarm.authelia.url = "https://auth.example.invalid";
     swarm.otel.clientSecretFile = "/var/lib/swarm-otel-oidc/by-hand.secret";
   };
 
@@ -376,6 +398,36 @@ let
         rule: lib.hasInfix "/run/test-grafana-sock" rule
       ) grafanaOldPath.systemd.tmpfiles.rules;
     }
+    {
+      # Reads the daemon's rendered unit, not the options: the queue address
+      # arrives as an env var whose whole attrset is guarded on `natsUrl`, and
+      # the secret as a systemd credential. A rename that resolved but stopped
+      # reaching the module leaves hive-c0re coming up perfectly and reporting
+      # to nobody, which is the one failure this option set exists to prevent.
+      # The third arm is the option that did NOT move, read out of the same
+      # attrset: the guard and the value beside it now come from different
+      # namespaces, so a hive that renders one and drops the other is exactly
+      # what a split can silently produce.
+      name = "a config written against the pre-rename statusPublish paths still reaches the daemon";
+      ok =
+        let
+          u = statusPublishOldPath.systemd.services.hive-c0re;
+        in
+        u.environment.HIVE_C0RE_NATS_URL == "nats://10.0.0.9:4222"
+        && u.environment.HIVE_C0RE_OIDC_TOKEN_ENDPOINT == "https://auth.example.invalid/api/oidc/token"
+        && lib.any (c: lib.hasInfix "/run/secrets/status-client.secret" c) u.serviceConfig.LoadCredential;
+    }
+    {
+      # The collector's half of the same split, and a different arm from the
+      # authenticator case below: this one reads the PATH the unit loads, so a
+      # reader left on a source that is non-null but wrong still fails. The
+      # fixture spells the option its pre-rename way, so it covers the rename
+      # entry at the same time.
+      name = "a config written against the pre-rename otel secret path still loads it as a credential";
+      ok =
+        lib.any (c: lib.hasInfix "/var/lib/swarm-otel-oidc/by-hand.secret" c)
+          otelRemoteAuthelia.containers.swarm-otel.config.systemd.services.opentelemetry-collector.serviceConfig.LoadCredential;
+    }
     {
       name = "a config written against the pre-rename authelia usersFile still reaches the bridge";
       ok =