make bao readers want swarm-bao-pki and drop its start limit

A pki start refused by its start limit failed every reader that
Requires= it with `dependency`. That leaves a unit inactive, not
failed, so Restart=on-failure never fired and readers without a
refresh timer never ran again (#5381: grafana 502 for ~43 min).

Readers and granting units now Wants= + After= pki; one whose leaf is
still missing fails its login with exit 1 into its existing retry.
pki gets StartLimitIntervalSec=0: it is deliberately not
RemainAfterExit, so each reader's start re-runs it.

nix/module-eval/forge-placement.nix

@@ -190,8 +190,8 @@ let
           == "/etc/pki/bao-ci-runner.pem";
     }
     {
-      # The store's units exist only on its host; `Requires=` on an absent one
-      # fails the fetch's start. The arm where the store is here is in
+      # The store's units exist only on its host, so elsewhere the fetch waits
+      # on nothing local. The arm where the store is here is in
       # ./swarm-services-switch.nix.
       name = "the CI runner's token fetch names none of the store's units on a host without the store";
       ok =