keep the operator list under one key and read it with one direct get

The agent read the operator-profiles bucket with a keys() listing, an
ordered consumer whose grant (STREAM.INFO, CONSUMER.CREATE) and flow-control
reply had never run against a permissioned queue. The controller now writes
the whole list as one JSON array under one key, only when it changed, and
the agent reads it with one DIRECT.GET the way agent_inference::read_own
reads its key. The agent grant shrinks to that one subject.

nix/host-modules/swarm-nats.nix

@@ -905,8 +905,9 @@ in
                 # the harness and the subagent daemon read the tool permissions
                 # it holds.
                 "--agent-token-publish-subject ${lib.escapeShellArg "\$\$JS.API.DIRECT.GET.KV_agent-permissions.\$\$KV.agent-permissions.{agent}"}"
-                # Every agent also reads the whole `operator-profiles` bucket.
-                # That grant names no agent, so the responder adds it itself
+                # Every agent also reads the operator list, the one key of the
+                # `operator-profiles` bucket, with one direct get. That grant
+                # names no agent, so the responder adds it itself
                 # (`swarm-nats-auth`'s `Policy::agent_token_permissions`).
                 "--store-cert-role ${lib.escapeShellArg authCertRole}"
               ];