agents get a todo when assigned to an issue or PR, rewritten when unassigned and cleared on close

A new swarm service, swarm-notify-router, in its own container on the host
that sets deploy.notify-router.enable (defaulted on by allSwarmServices where
the host has the router's store leaf, like the claude login minter).

- swarm-controller registers instance-wide hooks for `issues` +
  `issue_assign` and `pull_request` + `pull_request_assign`, updates the
  event list of a hook already registered with fewer (leaving its active flag as it is), and keeps each
  verified body unchanged in the SWARM_EVENTS stream on
  $SWARM.events.forge.<X-Forgejo-Event-Type>, deduped by X-Forgejo-Delivery.
  A delivery the stream did not keep answers 503.
- swarm-notify-router drains its durable consumer on that stream, runs its
  flows (source -> match -> todo sink, stored as nodes plus edges and checked
  to be a tree) and queues each op on $SWARM.router.todo.<agent> in the
  work-queue stream ROUTER_TODOS. Built-in flows: assigned, unassigned (same
  key, rewritten) and closed (prefix-clears every holder's router todos). A
  per-issue snapshot in its notify-router-state bucket holds the last
  assignees and the todo holders; only agents in the agent-status bucket get
  ops, and an assignee that was not one is left out of the snapshot so the
  next assign event retries it. After the first event that must be retried,
  the rest of the batch is nakked so redelivery keeps stream order.
- hive-agent creates its own durable consumer todo-<agent> and applies each
  op to its todo store as subsystem `router`, then acks; a refused op stops
  the rest of its batch the same way. The store's (subsystem, key) dedup
  makes a redelivery harmless. New Todos::clear_prefix.
- swarm-nats-auth: a --notify-router-client arm; the controller may publish
  $SWARM.events.forge.*; each agent gets three {agent} templates (extended
  consumer create whose filter the server checks, MSG.NEXT, ACK).
- Credentials: a notify-router store leaf minted by glue-bao-tls, a
  swarm-notify-router bao policy (read on its own queue client secret), an
  authelia machine client, the secret publisher entry, a journal forwarder
  route. No manual step.

hive-forge-notify is unchanged, so agents also still get forge's own
notifications.

Refs #5571

docs/swarm/services.md

@@ -342,16 +342,16 @@ gateway either way.
 | `swarm.otel.port`   | Only if something else on the services host already claims `4319`.                      |
 
 The `swarm-bao`, `swarm-nats`, `swarm-builder`, `swarm-claude-login`,
-`swarm-review-classifier`, `swarm-ci-runner`, `swarm-grafana`,
+`swarm-notify-router`, `swarm-review-classifier`, `swarm-ci-runner`, `swarm-grafana`,
 `swarm-victorialogs`, `swarm-victoriametrics`, `swarm-authelia`, `hive-forge`
 and `hive-matrix` containers each run a collector of their own that forwards the container's
 journal here, on a route and receiver per service
 (`https://<swarm.otel.domain>/<container>/`), authenticated as an OIDC client
-of that service's. The queue, builder, login minter and classifier reuse the
-service's own client; the store, CI runner, Grafana, log store, metrics store,
+of that service's. The queue, builder, login minter, notification router and
+classifier reuse the service's own client; the store, CI runner, Grafana, log store, metrics store,
 authelia, forge and homeserver have a forwarder client of their own
 (`swarm.<service>.otel.clientId`). Their records carry `service.name` (`bao`,
-`nats`, `builder`, `claude-login`, `review-classifier`, `ci-runner`,
+`nats`, `builder`, `claude-login`, `notify-router`, `review-classifier`, `ci-runner`,
 `grafana`, `victorialogs`, `victoriametrics`, `authelia`, `forgejo`,
 `tuwunel`) and no `hive` label. The forwarder of all but the store's is
 `nix/container-modules/swarm-journal-forwarder.nix`.
@@ -473,3 +473,24 @@ secret store by name, under its own `claude-login` leaf, and reaches claude's
 login endpoints over the network. On a host without the store, that leaf is
 the one file to copy, as for the CI runner. The flow and the version rule are
 in [`claude-login.md`](claude-login.md).
+
+### Notification router
+
+The notification router, in a `swarm-notify-router` container on the host
+that sets `deploy.notify-router.enable`. `allSwarmServices` defaults it on
+wherever the host has the router's store identity, on the review classifier's
+terms. Run one: it handles each issue's events in order.
+
+swarm-controller keeps every `issues` and `pull_request` delivery from its
+instance-wide hooks in the `SWARM_EVENTS` stream. The router reads that
+stream and queues todos for the agents an event concerns: an agent assigned to
+an issue or pull request gets a todo, one taken off it gets that todo rewritten
+to say so, and closing it clears them. Each agent's harness takes its todos
+from the `ROUTER_TODOS` stream, so an agent that's down gets them when it's
+back.
+
+It needs neither the forge nor a hive on its host, and holds no forge token.
+It reaches the queue and the secret store by name, under its own
+`notify-router` leaf. On a host without the store, that leaf is the one file to
+copy, as for the CI runner. The flows and the delivery path are in
+[`notify-router.md`](notify-router.md).