swarm-controller reads its forge token from the store, not a host file

The controller's forge token never entered bao: the forge minted it in its
container, hive-forge-swarm-controller-token copied it to a host file, and the
controller LoadCredential'ed that file. forgeTokenFile defaulted to that path
only where the forge ran, so a controller on any other host had no forge
access unless an operator copied the file by hand.

Now the forge's host publishes it and the controller reads it:

- swarm-bao-forge-publisher (replaces hive-forge-swarm-controller-token)
  waits for the in-container token, logs in with its own forge-publisher leaf
  and writes it to swarm/controller/swarm-controller/forge/token. It runs on
  every forge container start, the old unit's trigger.
- New principal swarm-forge-publisher: leaf minted by glue-bao-tls.nix,
  policy create/update on that one path, written by
  swarm-bao-forge-publisher-policy, CN reserved as a hive name.
- The controller policy gains read on that path. swarm-controller reads it
  at start under its own certificate with the OIDC secret's retry, and runs
  without forge access if it still cannot.
- forgeTokenFile, its LoadCredential and the forgeEnv gate are gone;
  SWARM_CONTROLLER_FORGE_URL is always set. hostSwarmControllerTokenFile is
  removed, and a tmpfiles rule deletes the old host copy on the forge host.

The in-container file stays: the mint unit's only-once guard reads it, and
it is the publisher's source.

Refs #4998

nix/host-modules/swarm-bao.nix

@@ -369,9 +369,9 @@ let
   # Each hive's matrix sender token (`matrix_account::hive_sender`) grants `read`
   # for the same keep-if-live reason, and `+` for the same glob-only-as-last-segment reason.
   #
-  # The swarm appservice token and its own OIDC client secret, read-only: it
-  # uses both and writes neither. matrix-ctl publishes the token
-  # (`matrixCtlPolicyText` below), the publisher the secret.
+  # Three leaves it reads and never writes: the swarm appservice token
+  # (matrix-ctl, `matrixCtlPolicyText` below), its own OIDC client secret (the
+  # publisher) and its own forge token (the forge's host, `forgePublisherWriters`).
   #
   # The agent PKI grant is its only path on that mount: it can ask the one role
   # for a certificate, not write that role or reach the issuer.
@@ -445,6 +445,10 @@ let
       capabilities = ["read"]
     }
 
+    path "${credentialMountPath}/data/${controllerForgeTokenLeaf}" {
+      capabilities = ["read"]
+    }
+
     path "${agentPkiMountPath}/issue/${agentPkiRoleName}" {
       capabilities = ["update"]
     }
@@ -545,6 +549,11 @@ let
   # it; the controller reads it and holds no other copy.
   controllerClientLeaf = "swarm/controller/swarm-controller/oidc/client";
 
+  # The controller's own forge token, the nix half of
+  # `swarm_secret_client::forge::controller_token_path`. The forge's host writes
+  # it; the controller reads it and holds no other copy.
+  controllerForgeTokenLeaf = "swarm/controller/swarm-controller/forge/token";
+
   # The forge's runner registration token, the nix half of
   # `swarm_secret_client::ci::registration_token_path`. The controller writes
   # it and cannot read it back (`forge::runner_token` keeps the value it last
@@ -922,6 +931,21 @@ let
     }
   ];
 
+  # The forge's host, publishing the controller's forge token. The one writer
+  # of the path, and write-only like the secret publisher: it copies a file in
+  # and never reads one back.
+  forgePublisherWriters = [
+    {
+      name = "swarm-forge-publisher";
+      cn = baoDeploy.forgePublisherCommonName;
+      policyText = ''
+        path "${credentialMountPath}/data/${controllerForgeTokenLeaf}" {
+          capabilities = ["create", "update"]
+        }
+      '';
+    }
+  ];
+
   # The role name IS the policy name, as for the three service principals
   # above: the role attaches the policy by spelling it identically, and one
   # string for both objects removes the way they drift apart.
@@ -1721,6 +1745,20 @@ in
       '';
     };
 
+    forgePublisherCommonName = lib.mkOption {
+      type = lib.types.str;
+      default = "swarm-forge-publisher";
+      description = ''
+        Subject the store's `swarm-forge-publisher` cert-auth role accepts: the
+        identity `swarm-bao-forge-publisher`, the unit on the forge's host that
+        publishes the swarm-controller's forge token, presents. Its grant is
+        one path, `swarm/controller/swarm-controller/forge/token`, and write
+        only.
+
+        ⚠️ Reserved as a hive name by ./swarm.nix, like its siblings.
+      '';
+    };
+
     queueAgentCommonNamePrefix = lib.mkOption {
       type = lib.types.str;
       default = "swarm-bao-queue-agent";
@@ -1954,6 +1992,32 @@ in
       '';
     };
 
+    forgePublisherClientCertFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/var/lib/swarm-bao-pki/forge-publisher.pem";
+      description = ''
+        Certificate the unit that publishes the swarm-controller's forge token
+        presents to the store. Its subject must be
+        {option}`services.hyperhive.deploy.bao.forgePublisherCommonName`.
+
+        ./glue-bao-tls.nix points it at the leaf it mints on the store's host.
+        On a forge host without the store, it is a file the operator copies
+        from the store's host. A path, never a value.
+      '';
+    };
+
+    forgePublisherClientKeyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/var/lib/swarm-bao-pki/forge-publisher-key.pem";
+      description = ''
+        Private key for
+        {option}`services.hyperhive.deploy.bao.forgePublisherClientCertFile`.
+        A path, never a value.
+      '';
+    };
+
     servicesIssuerClientCertFile = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
@@ -3053,6 +3117,8 @@ in
 
       systemd.services.swarm-bao-ci-runner-policy = readerPolicyUnit "write the CI runner's registration-token-reader bao policy and cert-auth role" ciRunnerReaders;
 
+      systemd.services.swarm-bao-forge-publisher-policy = readerPolicyUnit "write the forge's controller-token-publisher bao policy and cert-auth role" forgePublisherWriters;
+
       # A FOURTH sibling, same shape and same reasons as the two above. This
       # one is what turns `swarm-services-issuer` from a declaration into a
       # grant: a bao policy reaches nothing until a login role hands it to a
@@ -3258,6 +3324,7 @@ in
           "swarm-bao-nats-tls-policy.service"
           "swarm-bao-hive-leaf-policy.service"
           "swarm-bao-ci-runner-policy.service"
+          "swarm-bao-forge-publisher-policy.service"
         ]
         ++ granterAfter;
         requires = [ "swarm-bao-pki.service" ];