fixture: repair 4 CI failures uncovered on rebase

Refs #4374

- otelNoIdentity: name journaldUnits so the fixture trips the store-
  identity path it's testing instead of swarm-otel's unrelated
  journald-safety assertion (an empty list with log collection on is
  refused as "collect everything", not "collect nothing").
- otelNoStores: give it a bao client identity. The secret gate moved
  from deployCfg.authelia.enable to a real client cert/key pair, so a
  fixture meaning "no telemetry stores" now needs its own secret
  identity to keep exercising the exporter/authenticator wiring it
  was written for.
- docs/swarm/secrets.md: two vale fixes — a contraction, and drop a
  condescending "simply".

docs/swarm/secrets.md

@@ -82,7 +82,7 @@ The client it reads for is registered unconditionally, the same call
 bearer-authz client with no audience, and the push audiences supply one even
 for a collector with nothing published to scrape.
 
-⚠️ **A collector with no store identity is not refused.** Unlike Grafana,
+⚠️ **A collector with no store identity isn't refused.** Unlike Grafana,
 where an absent OIDC block is a container with no way in at all, a collector
 with nothing to authenticate with still receives every hive's telemetry —
 only its own pushes to the stores go out unauthenticated and get refused
@@ -219,7 +219,7 @@ runs the collector, and registration lives separately in
 `glue-swarm-otel-oidc-client.nix` for the same reason Grafana's does. Where it
 differs is what an absent credential means: the collector still receives
 telemetry with none, so `swarm-otel.nix` doesn't assert
-`deploy.bao.clientCertFile` / `clientKeyFile` the way Grafana does — it simply
+`deploy.bao.clientCertFile` / `clientKeyFile` the way Grafana does — it
 doesn't render the reading unit without them, the shape
 `glue-matrix-bao-token.nix` and `glue-queue-agent-credential.nix` use for
 their own optional reads.