swarm-controller reads its forge token from the store, not a host file

The controller's forge token never entered bao: the forge minted it in its
container, hive-forge-swarm-controller-token copied it to a host file, and the
controller LoadCredential'ed that file. forgeTokenFile defaulted to that path
only where the forge ran, so a controller on any other host had no forge
access unless an operator copied the file by hand.

Now the forge's host publishes it and the controller reads it:

- swarm-bao-forge-publisher (replaces hive-forge-swarm-controller-token)
  waits for the in-container token, logs in with its own forge-publisher leaf
  and writes it to swarm/controller/swarm-controller/forge/token. It runs on
  every forge container start, the old unit's trigger.
- New principal swarm-forge-publisher: leaf minted by glue-bao-tls.nix,
  policy create/update on that one path, written by
  swarm-bao-forge-publisher-policy, CN reserved as a hive name.
- The controller policy gains read on that path. swarm-controller reads it
  at start under its own certificate with the OIDC secret's retry, and runs
  without forge access if it still cannot.
- forgeTokenFile, its LoadCredential and the forgeEnv gate are gone;
  SWARM_CONTROLLER_FORGE_URL is always set. hostSwarmControllerTokenFile is
  removed, and a tmpfiles rule deletes the old host copy on the forge host.

The in-container file stays: the mint unit's only-once guard reads it, and
it is the publisher's source.

Refs #4998

nix/module-eval/core-toggle.nix

@@ -76,16 +76,16 @@ let
         && centralToggleOff.services.hyperhive.swarm.forge.publicUrl == "https://forge.t.local";
     }
     {
-      # The controller's token path follows where the forge runs
+      # The controller's token publisher follows where the forge runs
       # (./forge-placement.nix), never the central toggle: a forge host with
-      # the toggle off still renders the path.
-      name = "the swarm controller's forgeTokenFile default does not consult the central toggle";
+      # the toggle off still publishes it.
+      name = "the forge's controller-token publisher does not consult the central toggle";
       ok =
         (hive {
           deploy.hive-controller.enable = false;
           deploy.forgejo.enable = true;
-        }).services.hyperhive.deploy.swarm-controller.forgeTokenFile
-        == "/var/lib/hyperhive-forge/swarm-controller.token";
+        }).systemd.services
+          ? swarm-bao-forge-publisher;
     }
     {
       name = "a hive that does not host the swarm's shared services runs none of them";