export bao client-cert not_before/not_after gauges and alert past 80% of lifetime

hive-agent/Cargo.toml

@@ -58,6 +58,8 @@ swarm-queue-client = { workspace = true, features = [
 ] }
 # The spelling of the token the queue connection presents.
 swarm-agent-verify.workspace = true
+# The `bao.client_cert.*` gauges on this exporter.
+swarm-cert-metrics.workspace = true
 swarm-wire.workspace = true
 # This agent's own queue secret, read from the store under its own certificate.
 swarm-secret-client.workspace = true

hive-agent/src/otel_turn_metrics.rs

@@ -181,6 +181,7 @@ fn build() -> Option<Instruments> {
         Ok(provider) => {
             tracing::info!(?interval, "otel turn-metrics: exporter enabled");
             let meter = provider.meter("hyperhive.turn_stats");
+            swarm_cert_metrics::register(&meter, "agent");
             Some(Instruments {
                 turn_duration_ms: meter
                     .u64_histogram("hyperhive.agent.turn.duration")