export bao client-cert not_before/not_after gauges and alert past 80% of lifetime

hive-c0re/src/stats/otel_metrics.rs

@@ -261,6 +261,9 @@ fn register_instruments(provider: &SdkMeterProvider, snapshot: Arc<Mutex<Vec<Con
 /// instruments use would move that window rather than close it, and exists
 /// only because `gather()` is async — which `readiness()` is not.
 fn register_hive_instruments(meter: &opentelemetry::metrics::Meter) {
+    // The hive's own store certificate (`client.pem`, `BAO_CLIENT_CERT`).
+    swarm_cert_metrics::register(meter, "client");
+
     // Seconds since the exporter started. A hive that is up reports this every
     // interval whether or not it hosts a single agent, which is what makes
     // "no agents" distinguishable from "not reporting"; a restart reads as a