name the mint, not the publisher, as the writer of the client secrets

Finishes the sweep of prose that said the publisher unit writes or carries the OIDC client secrets: rust docs, nix comments and option descriptions, test names and docs.

nix/module-eval/bao-otel-collector.nix

@@ -421,7 +421,7 @@ let
       # for: the reader's grant is one path under `services`, so a secret
       # filed under the hive that happens to run the store would be refused
       # rather than missing, however correct the path reads.
-      name = "the forwarder's secret is read from the prefix the publisher writes";
+      name = "the forwarder's secret is read from the prefix the mint writes";
       ok =
         let
           s = baoWithCollector.systemd.services.swarm-bao-forwarder-oidc.script;