hive TLS: re-issue a services leaf that does not chain to the store's root, delete the hive CA's leftovers

- swarm-services-cert (and its daily renewal) treats a services leaf that
  `openssl verify` rejects against swarm-services-root.pem as invalid and
  asks the store for a new one, as hive-tls-resign already does for the
  gateway leaf. The trust bundle is that root alone, so a leaf under any
  other issuer verifies for no consumer. With the store unreachable the
  unit fails, and where the gateway waits for the leaf, the import fails
  with it.
- Every host also deletes the old hive CA's ca.srl and .swarm-ca-adopted
  in deploy.hive-controller.tls.stateDir, with the same tmpfiles `r`
  rules as ca.pem/ca-previous.pem/ca-key.pem. Nothing reads either.
- docs/swarm/ca.md: the services leaf's re-issue conditions, the two
  extra deleted files, and that the deletion is irreversible: rolling back
  to a generation with swarm-ca.service mints a new, unrelated root that
  nothing issues under.

module-eval hive-tls: a case for the services-leaf check in the boot
issuance and the renewal (red with the line removed), and the deletion
case covers the two extra files.

Refs #4588

nix/module-eval/hive-tls.nix

@@ -131,6 +131,22 @@ let
         && lib.hasInfix ''-in "$svcleaf" -noout -checkend "$renewat"'' boot.script
         && lib.hasInfix "max_ttl=48h" shortTtl.systemd.services.swarm-bao-controller-policy.script;
     }
+    {
+      # Checked on the decision side of the exit, in the boot issuance and
+      # the renewal both.
+      name = "the services leaf is re-issued when it does not chain to the store's root";
+      ok =
+        let
+          verify = ''openssl verify -CAfile "$svcroot" "$svcleaf" >/dev/null 2>&1 || reissue=1'';
+          decides =
+            u:
+            let
+              decision = lib.head (lib.splitString ''if [ "$reissue" = 0 ]'' u.script);
+            in
+            decision != u.script && lib.hasInfix verify decision;
+        in
+        decides boot && decides triggered;
+    }
     {
       # The store replaces its root once it has less than one leaf lifetime
       # left, and the hive asks for a fresh leaf, with the new root, at that
@@ -335,6 +351,8 @@ let
               "ca.pem"
               "ca-previous.pem"
               "ca-key.pem"
+              "ca.srl"
+              ".swarm-ca-adopted"
             ];
           relocated = hiveWithController { deploy.hive-controller.tls.stateDir = "/srv/hive-tls"; };
         in
@@ -342,6 +360,8 @@ let
           "/ca.pem"
           "ca-previous.pem"
           "ca-key.pem"
+          "ca.srl"
+          ".swarm-ca-adopted"
         ])
         && reads allLocal "swarm-services-root.pem"
         && deletes allLocal "/var/lib/hive-tls"