swarm-controller reads its forge token from the store, not a host file

The controller's forge token never entered bao: the forge minted it in its
container, hive-forge-swarm-controller-token copied it to a host file, and the
controller LoadCredential'ed that file. forgeTokenFile defaulted to that path
only where the forge ran, so a controller on any other host had no forge
access unless an operator copied the file by hand.

Now the forge's host publishes it and the controller reads it:

- swarm-bao-forge-publisher (replaces hive-forge-swarm-controller-token)
  waits for the in-container token, logs in with its own forge-publisher leaf
  and writes it to swarm/controller/swarm-controller/forge/token. It runs on
  every forge container start, the old unit's trigger.
- New principal swarm-forge-publisher: leaf minted by glue-bao-tls.nix,
  policy create/update on that one path, written by
  swarm-bao-forge-publisher-policy, CN reserved as a hive name.
- The controller policy gains read on that path. swarm-controller reads it
  at start under its own certificate with the OIDC secret's retry, and runs
  without forge access if it still cannot.
- forgeTokenFile, its LoadCredential and the forgeEnv gate are gone;
  SWARM_CONTROLLER_FORGE_URL is always set. hostSwarmControllerTokenFile is
  removed, and a tmpfiles rule deletes the old host copy on the forge host.

The in-container file stays: the mint unit's only-once guard reads it, and
it is the publisher's source.

Refs #4998

nix/module-eval/bao-controller.nix

@@ -197,6 +197,27 @@ let
         && builtins.elem "bao-client.pem:/var/lib/swarm-bao-pki/controller.pem" s.swarm-controller.serviceConfig.LoadCredential
         && builtins.elem "bao-client-key.pem:/var/lib/swarm-bao-pki/controller-key.pem" s.swarm-controller.serviceConfig.LoadCredential;
     }
+    {
+      # The forge token comes from the store, so the unit is handed no file for
+      # it, and neither fixture runs the forge: a controller reaches it by name
+      # wherever it runs.
+      name = "the controller is handed no forge token file, and is pointed at the forge away from it";
+      ok =
+        lib.all
+          (
+            m:
+            let
+              u = m.systemd.services.swarm-controller;
+            in
+            !(lib.any (c: lib.hasPrefix "forge-token:" c) u.serviceConfig.LoadCredential)
+            && !(u.environment ? SWARM_CONTROLLER_FORGE_TOKEN_FILE)
+            && u.environment.SWARM_CONTROLLER_FORGE_URL == "https://forge.t.local"
+          )
+          [
+            baoControllerHere
+            controllerNoStore
+          ];
+    }
     {
       # A hive's cert-auth role carries the authority by value, so the daemon
       # has to be handed the file rather than a path into the store's own