swarm-secret-client: hives no longer read swarm/services/*

The hive policy rendered by policy::render granted every hive cert read
on secret/data/swarm/services/*, which holds each swarm service's OIDC
client secret. No reader of that tree authenticates with a hive cert:
grafana, the otel collector and the store forwarder each read with
their own leaf, and the bao UI's secret is read by the store's granter.

render() now emits two stanzas: swarm/agents/* and the hive's own
swarm/hives/<hive>/*. Kind::Service had no other caller and is removed.
Docs and comments that described the grant as a decision are rewritten
to the current state.

Closes #4960

nix/module-eval/bao-grants.nix

@@ -482,7 +482,7 @@ let
     # ── the four readers that used to share the hive's own leaf ──────────────
     #
     # 🩸 Until this split all four presented `deploy.bao.clientCertFile`, whose
-    # policy grants read on `swarm/agents/*`, `swarm/hives/<hive>/*` AND
+    # policy granted read on `swarm/agents/*`, `swarm/hives/<hive>/*` AND
     # `swarm/services/*`. Four principals behind one certificate are one
     # principal to bao, so the only expressible grant was the union: the unit
     # fetching Grafana's OIDC secret could fetch every agent credential in the

nix/module-eval/secret-publisher.nix

@@ -88,7 +88,7 @@ let
     {
       # The controller reads this exact path
       # (`swarm_secret_client::queue::controller_client_path`, pinned by that
-      # crate's own test). Not under `services/`, which every hive reads: this
+      # crate's own test). Under `controller/`, which no hive reads: this
       # client may read every hive's status.
       name = "the publisher writes the controller's client under controller/, never services/";
       ok =