swarm-controller: re-issue agent certificates and re-mint queue secrets at half-life

A five-minute pass over every agent some hive's wanted state declares as
anything but destroyed queues, per agent:

- `MintAgentIdentity` (the node agent creation uses) when the stored
  certificate at swarm/agents/<agent>/bao-mtls is past half its validity,
  read from its own notBefore/notAfter: day 45 of the role's 90;
- the new `RenewAgentQueueCredential` node when the queue secret at
  swarm/agents/<agent>/queue is 45 days old or has no mint time. The node
  re-decides, writes a fresh value with `minted_at`, reads it back, and logs
  the agent and the old age.

When both are due the secret node runs after_any the certificate node,
because mint_and_verify compares the queue secret it read with the one it
reads back. A credential that is not stored is never created here.

`queue::AgentCredential` gains an optional `minted_at` (unix seconds);
agent creation now sets it. Stored objects without it decode unchanged and
count as due, so every existing queue secret is re-minted on the first pass.

Both replacements reach the agent at its next start. The old certificate
stays valid until it expires; the old queue secret does not, so a queue
reconnect before that restart is denied.

Adds x509-cert 0.2 (with der_derive and flagset) to read the validity.

docs/swarm/credentials.md: the renewal column splits into automatic re-mint
and automatic re-pull, filled from the code as it stands.

nix/host-modules/swarm-bao.nix

@@ -699,8 +699,8 @@ let
   # reason: the mount is tuned to it before generation, or bao clamps it.
   agentPkiRootTtl = "262800h";
 
-  # The agent leaf's window, pinned on the role. Nothing re-issues a leaf
-  # before it ends; an operator re-runs agent creation.
+  # The agent leaf's window, pinned on the role. `swarm-controller` re-issues a
+  # live agent's leaf once it is past half of it (`agent_renewal.rs`).
   agentPkiLeafTtl = "2160h";
 
   # The agent CA's certificate, cached on this host by `swarm-bao-agent-pki`,