copy the cache's pull facts to each hive and create them in the in-swarm cache

the in-swarm cache stores its address, name and public key beside its tokens, create-only. swarm-controller copies the four cache facts to swarm/hives/<hive>/attic/* every five minutes, with read on the sources and write on the copies. part 1 of 3: nothing reads the copies until the hive reader and probe land.

nix/host-modules/swarm-bao.nix

@@ -482,6 +482,14 @@ let
       capabilities = ["create", "read", "update"]
     }
 
+    ${lib.concatMapStrings readStanza (
+      map (leaf: "${credentialMountPath}/data/${leaf}") atticFactLeaves
+    )}
+    ${lib.concatMapStrings (name: ''
+      path "${credentialMountPath}/data/swarm/hives/+/attic/${name}" {
+        capabilities = ["create", "read", "update"]
+      }
+    '') atticHiveFactNames}
     path "${credentialMountPath}/data/${ciRunnerTokenLeaf}" {
       capabilities = ["create", "update"]
     }
@@ -718,6 +726,28 @@ let
   atticJwtLeaf = "swarm/services/attic/jwt-secret";
   atticPullTokenLeaf = "swarm/services/attic/pull-token";
 
+  # The cache's three public facts, beside the pull token: its address, its
+  # name, and the key its narinfo are signed with. The in-swarm cache's host
+  # unit creates them; for an external cache the operator writes them.
+  # `swarm-controller` reads all four and copies each to
+  # `swarm/hives/<hive>/attic/<name>`
+  # (`swarm_secret_client::attic::Leaf`).
+  atticUrlLeaf = "swarm/services/attic/url";
+  atticCacheLeaf = "swarm/services/attic/cache";
+  atticPublicKeyLeaf = "swarm/services/attic/public-key";
+  atticFactLeaves = [
+    atticPullTokenLeaf
+    atticUrlLeaf
+    atticCacheLeaf
+    atticPublicKeyLeaf
+  ];
+  atticHiveFactNames = [
+    "pull-token"
+    "url"
+    "cache"
+    "public-key"
+  ];
+
   # The CI run poller's forge token, the nix half of
   # `swarm_secret_client::ci_metrics::forge_token_path`. The controller mints it
   # and reads it back before deciding whether to re-mint; the poller reads it
@@ -1199,7 +1229,7 @@ let
     }
   ];
 
-  # The in-swarm cache's three secrets, create and read and nothing more: its
+  # The in-swarm cache's six secrets, create and read and nothing more: its
   # host units create each one only while it is absent, so none needs `update`,
   # and a rewrite of a signing key or a token an operator holds is refused. The
   # cache container's journal forwarder reads its client secret under the same
@@ -1215,11 +1245,13 @@ let
               capabilities = ["create", "read"]
             }
           '')
-          [
-            atticJwtLeaf
-            atticPushTokenLeaf
-            atticPullTokenLeaf
-          ]
+          (
+            [
+              atticJwtLeaf
+              atticPushTokenLeaf
+            ]
+            ++ atticFactLeaves
+          )
         + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.attic.otel.clientId}/oidc/client";
     }
   ];
@@ -2474,8 +2506,8 @@ in
       description = ''
         Subject the store's `swarm-attic` cert-auth role accepts: the identity
         the in-swarm cache's host units present. Its grant is create and read on
-        three paths, `swarm/services/attic/jwt-secret`, `push-token` and
-        `pull-token`, and nothing else.
+        six paths under `swarm/services/attic/`, `jwt-secret`, `push-token`,
+        `pull-token`, `url`, `cache` and `public-key`, and nothing else.
 
         ⚠️ Reserved as a hive name by ./swarm.nix, like its siblings.
       '';