hive-tls: give swarm-services-cert the cmp it tests the root with

`cmp` lives in diffutils, not coreutils, so the root-changed test exited
127 with "command not found". Inside `if ! cmp -s`, a 127 reads as
"differs" and errexit never sees it, so `rootchanged` was 1 on every run
and the trust-bundle rebuild it guards bounced `hive-tls-ca` after each
issuance — the exact "only a changed one, or every boot would bounce a
unit with nothing to do" the comment there rules out.

Found in the journal of a hive that had just issued a leaf successfully:
the unit logged "the services root changed" on a run where the store had
left the issuer alone.

nix/host-modules/hive-tls.nix

@@ -693,6 +693,11 @@ in
         pkgs.openssl
         pkgs.coreutils
         pkgs.systemd
+        # `cmp`, which is NOT in coreutils. Without it the root-changed test
+        # below is `command not found` — 127, invisible under `if !`, and
+        # therefore always "changed", so the bundle rebuild it guards fired
+        # on every issuance instead of on a new root.
+        pkgs.diffutils
       ];
       # Sized like the store's own granting units, and for the same
       # reason: under `seal = "shamir"` an operator unseals BY HAND, and