export bao client-cert not_before/not_after gauges and alert past 80% of lifetime

hive-c0re/Cargo.toml

@@ -62,6 +62,8 @@ swarm-queue-client = { workspace = true, features = [
   "agent-permissions",
   "agent-archetype",
 ] }
+# The `bao.client_cert.*` gauges on this exporter.
+swarm-cert-metrics.workspace = true
 swarm-matrix-client.workspace = true
 swarm-secret-client.workspace = true
 swarm-wire.workspace = true

hive-c0re/src/stats/otel_metrics.rs

@@ -261,6 +261,9 @@ fn register_instruments(provider: &SdkMeterProvider, snapshot: Arc<Mutex<Vec<Con
 /// instruments use would move that window rather than close it, and exists
 /// only because `gather()` is async — which `readiness()` is not.
 fn register_hive_instruments(meter: &opentelemetry::metrics::Meter) {
+    // The hive's own store certificate (`client.pem`, `BAO_CLIENT_CERT`).
+    swarm_cert_metrics::register(meter, "client");
+
     // Seconds since the exporter started. A hive that is up reports this every
     // interval whether or not it hosts a single agent, which is what makes
     // "no agents" distinguishable from "not reporting"; a restart reads as a