stop writing and attaching per-agent and per-hive bao policies

swarm-controller/src/main.rs

@@ -217,8 +217,8 @@ async fn main() -> Result<()> {
     // abandoned, since the two of them boot together.
     let hive_names: Vec<String> = hives.iter().map(|h| h.name.clone()).collect();
     read_policy::ensure_hive_access(hive_names).await;
-    // Agents keep the policy they were minted with until this rewrites it, so
-    // what `policy::render_agent` grants today reaches them only from here.
+    // The one policy every agent's role attaches, and the entity each agent's
+    // login is read under, are checked here at every start.
     read_policy::ensure_agent_policies().await;
 
     let state = AppState {