swarm-logs: authenticate as the agent with its own queue secret

swarm-logs reads `swarm/agents/<agent>/queue` from the swarm secret
store with the agent's own store certificate (the read hive-agent makes
for its queue connection) and presents it as
`Bearer swarm-agent.<agent>.<secret>`, which the gateway's
swarm-logs-auth checks. On a 401 it reads the secret again and retries
once, so a secret re-minted between the read and the check does not
fail the query.

The OIDC mint against the hive's shared `hive-<h>-agent` client is gone
from swarm-logs, along with the unused `HIVE_AGENT_OIDC_CA_FILE` anchor.
logs.nix now gates on the store address instead of the queue's token
endpoint and wraps the binary with the paths queue-identity.nix gives
the harness; the host forwards the query URL wherever it forwards a
store identity.

The shared client is still delivered into containers; removing that is

Part of #4459.

swarm-logs/Cargo.toml

@@ -12,13 +12,15 @@ path = "src/main.rs"
 anyhow.workspace = true
 clap.workspace = true
 clap-markdown = "0.1"
-# The whole point of the crate's dependency list: minting the access token
-# is `swarm_queue_client::mint_token_for_blocking`, not a second copy of
-# the `client_credentials` request. See `src/auth.rs`.
+# The agent-token spelling the gateway's responder parses, and the rustls
+# provider the store client needs.
 swarm-queue-client.workspace = true
-# Blocking, not async: this binary makes exactly two requests and exits, so
-# a reactor would exist only to be torn down. It also matches the token
-# minter reached for above, which is `swarm-queue-client`'s blocking one.
+# The read of this agent's own queue secret.
+swarm-secret-client.workspace = true
+# Only to drive that one async read; the query itself is blocking.
+tokio.workspace = true
+# Blocking, not async: this binary makes one request (two on a 401) and
+# exits, so a reactor would exist only to be torn down.
 reqwest = { workspace = true, features = ["blocking"] }
 serde_json.workspace = true