name the mint, not the publisher, as the writer of the client secrets

Finishes the sweep of prose that said the publisher unit writes or carries the OIDC client secrets: rust docs, nix comments and option descriptions, test names and docs.

nix/module-eval/swarm-otel-core.nix

@@ -125,7 +125,7 @@ let
       # Same 403-not-a-miss reason as grafana's arm above: the reader's grant
       # covers the `services` prefix, so a path outside it is refused rather
       # than empty, however correct it reads.
-      name = "the collector's OIDC secret is read from the prefix the publisher writes";
+      name = "the collector's OIDC secret is read from the prefix the mint writes";
       ok =
         let
           s = otelBaoRemoteAuthelia.systemd.services.swarm-bao-otel-oidc.script;