swarm-controller reads its forge token from the store, not a host file

The controller's forge token never entered bao: the forge minted it in its
container, hive-forge-swarm-controller-token copied it to a host file, and the
controller LoadCredential'ed that file. forgeTokenFile defaulted to that path
only where the forge ran, so a controller on any other host had no forge
access unless an operator copied the file by hand.

Now the forge's host publishes it and the controller reads it:

- swarm-bao-forge-publisher (replaces hive-forge-swarm-controller-token)
  waits for the in-container token, logs in with its own forge-publisher leaf
  and writes it to swarm/controller/swarm-controller/forge/token. It runs on
  every forge container start, the old unit's trigger.
- New principal swarm-forge-publisher: leaf minted by glue-bao-tls.nix,
  policy create/update on that one path, written by
  swarm-bao-forge-publisher-policy, CN reserved as a hive name.
- The controller policy gains read on that path. swarm-controller reads it
  at start under its own certificate with the OIDC secret's retry, and runs
  without forge access if it still cannot.
- forgeTokenFile, its LoadCredential and the forgeEnv gate are gone;
  SWARM_CONTROLLER_FORGE_URL is always set. hostSwarmControllerTokenFile is
  removed, and a tmpfiles rule deletes the old host copy on the forge host.

The in-container file stays: the mint unit's only-once guard reads it, and
it is the publisher's source.

Refs #4998

nix/module-eval/name-guards.nix

@@ -83,6 +83,13 @@ let
     swarm.hives.fwctl.domain = "f.t.local";
   };
 
+  # The forge publisher's, the one writer of the controller's forge token.
+  hiveNamedAfterForgePublisherSubject = hive {
+    deploy.swarm-otel.enable = false;
+    deploy.bao.forgePublisherCommonName = "fpctl";
+    swarm.hives.fpctl.domain = "fp.t.local";
+  };
+
   # The granter's, the one subject whose role may write every `swarm-*` grant.
   hiveNamedAfterGranterSubject = hive {
     deploy.swarm-otel.enable = false;
@@ -188,6 +195,16 @@ let
           a: !a.assertion && lib.hasInfix "'fwctl'" a.message
         ) hiveNamedAfterForwarderOidcSubject.assertions;
     }
+    {
+      # And the forge publisher's: a hive holding a leaf it accepts could
+      # replace the token the controller provisions every forge object with.
+      name = "a hive named after the forge publisher's subject is refused too";
+      ok =
+        equalityGuardFired hiveNamedAfterForgePublisherSubject
+        && lib.any (
+          a: !a.assertion && lib.hasInfix "'fpctl'" a.message
+        ) hiveNamedAfterForgePublisherSubject.assertions;
+    }
     {
       # And the granter's, whose role is root-equivalent: a hive holding a leaf
       # it accepts could grant itself anything.