feat(swarm): wire a hive's queue coordinates for status publishing

Three options, all three derived from ONE predicate — this host runs both
the queue and the IdP — so a defaulted set is all or nothing. Deriving
them per-service looks equivalent and is not: `enableRequiredServices`
turns on matrix and authelia but not nats, so an ordinary all-local hive
would resolve two of three and trip the assertion below. Making the
partial state unrepresentable is what keeps that assertion honest.

Deliberately not the shape swarm-controller uses. That module emits its
queue coordinates only when authelia and NATS are local, which is right
for a service that *is* a swarm-host service — but a hive is the one thing
in a swarm that routinely is not on the swarm host, so the same rule would
make status publishing work on exactly the deployment that needs it least.

There is no `enable`: three coordinates that are all set is the enable. An
extra flag would allow configured-but-off, which is one more state to
explain and one more way to be silently quiet.

A half-set trio is an eval error rather than a silent no-op, because its
runtime failure mode is the expensive kind — the daemon comes up fine,
never connects, and the hive reads never_reported on a dashboard nobody is
watching yet. With the defaults all-or-nothing, the assertion only ever
judges what an operator typed by hand.

The secret arrives by LoadCredential, not a copy: hive-c0re is a host
unit, so systemd hands it the file directly and the secret never gains a
second on-disk copy. The client id is not chosen here either — it is
`hive-<hiveName>`, the identity swarm-authelia.nix already declares for
every entry in the roster.

nix/host-modules/hive-c0re/default.nix

@@ -251,9 +251,20 @@ in
         # path. Same secret the agent containers get (forwarded there via
         # nspawn --load-credential); this just also hands it to c0re itself.
         # Empty list (no credential) when otel is off or no header is set.
-        LoadCredential = lib.optional (
-          config.services.hyperhive.otel.enable && config.services.hyperhive.otel.headersCredential != null
-        ) "otel-headers:${config.services.hyperhive.otel.headersCredential}";
+        LoadCredential =
+          lib.optional (
+            config.services.hyperhive.otel.enable && config.services.hyperhive.otel.headersCredential != null
+          ) "otel-headers:${config.services.hyperhive.otel.headersCredential}"
+          # The swarm-queue client secret this hive authenticates with to
+          # publish its own status. `LoadCredential` and not a copy: root
+          # reads the plaintext at unit start and hive-core sees it 0400
+          # under `%d`, so the secret never gains a second on-disk copy
+          # and the daemon never needs read access to wherever it lives.
+          # (The callout responder copies instead only because it
+          # delivers into a container, across a filesystem boundary.)
+          ++ lib.optional (
+            config.services.hyperhive.swarm.statusPublish.clientSecretFile != null
+          ) "swarm-status-client.secret:${config.services.hyperhive.swarm.statusPublish.clientSecretFile}";
         # Sandboxing. hive-c0re is unprivileged (runs as hive-core, never
         # setuid), makes HTTP requests to forge/matrix/Anthropic (keeps INET),
         # and delegates all privileged ops to hive-priv via a Unix socket.

nix/host-modules/hive-c0re/environment.nix

@@ -209,3 +209,22 @@ in
     in
     "${s.address}:${toString s.port}";
 }
+//
+  # Swarm-queue coordinates for offering this hive's status upward
+  # (hive-c0re::swarm_status). All four together or none: a half-set
+  # environment is a deployment bug the daemon refuses to treat as
+  # "no queue configured", because the failure it would otherwise
+  # produce is a hive that comes up fine and silently never reports.
+  # The three-option version of that same rule is asserted at eval in
+  # ./../swarm.nix, so this can only ever emit a complete set.
+  lib.optionalAttrs (config.services.hyperhive.swarm.statusPublish.natsUrl != null) {
+    HIVE_C0RE_NATS_URL = config.services.hyperhive.swarm.statusPublish.natsUrl;
+    HIVE_C0RE_OIDC_TOKEN_ENDPOINT = config.services.hyperhive.swarm.statusPublish.tokenEndpoint;
+    # The identity swarm-authelia.nix already declares for every entry in
+    # `swarm.hives` — the hive does not choose its own name here, it uses
+    # the one the roster gave it.
+    HIVE_C0RE_OIDC_CLIENT_ID = "hive-${config.services.hyperhive.hiveName}";
+    # `%d` is systemd's credentials directory — see the LoadCredential in
+    # ./default.nix. The daemon reads a path, never a value.
+    HIVE_C0RE_OIDC_CLIENT_SECRET_FILE = "%d/swarm-status-client.secret";
+  }