push green meta builds to the attic cache and record cached

nix/host-modules/swarm-bao.nix

@@ -692,6 +692,12 @@ let
   # to fetch config repos.
   builderForgeTokenLeaf = "swarm/services/builder/forge/token";
 
+  # The token the swarm builder pushes closures to the binary cache with, the nix
+  # half of `swarm_secret_client::builder::attic_push_token_path`. The operator
+  # writes it by hand; the builder reads it on every push, and nothing else in
+  # the swarm reaches it.
+  atticPushTokenLeaf = "swarm/services/attic/push-token";
+
   # The CI run poller's forge token, the nix half of
   # `swarm_secret_client::ci_metrics::forge_token_path`. The controller mints it
   # and reads it back before deciding whether to re-mint; the poller reads it
@@ -1146,14 +1152,16 @@ let
     }
   ];
 
-  # The swarm builder: its forge token, read once per build, and its own queue
-  # client secret, read at start. Both by the daemon inside its container.
+  # The swarm builder: its forge token, read once per build, the cache push token,
+  # read once per push, and its own queue client secret, read at start. All by the
+  # daemon inside its container.
   builderReaders = [
     {
       name = "swarm-builder";
       cn = baoDeploy.builderCommonName;
       policyText =
         readStanza "${credentialMountPath}/data/${builderForgeTokenLeaf}"
+        + readStanza "${credentialMountPath}/data/${atticPushTokenLeaf}"
         + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.builder.clientId}/oidc/client";
     }
   ];
@@ -2081,8 +2089,8 @@ in
       description = ''
         Subject the store's `swarm-builder` cert-auth role accepts: the
         identity the swarm builder presents from inside its container. Its
-        grant is two paths, read only: `swarm/services/builder/forge/token`
-        and its own queue client secret.
+        grant is three paths, read only: `swarm/services/builder/forge/token`,
+        `swarm/services/attic/push-token` and its own queue client secret.
 
         ⚠️ Reserved as a hive name by ./swarm.nix, like its siblings.
       '';