hive CA: delete ca.pem, ca-previous.pem and ca-key.pem, the bundle is the store's root

The gateway leaf comes from the store's pki mount, so a hive CA's
certificates anchor nothing and its key is a secret outside the store.

- hive-tls-ca writes trust-bundle.pem from swarm-services-root.pem alone;
  the ca.pem and ca-previous.pem slots are gone.
- Every host deletes ca.pem, ca-previous.pem and ca-key.pem in
  deploy.hive-controller.tls.stateDir with tmpfiles `r` rules that follow
  the option. The removal shim, now host-ca-removed.nix, holds these
  beside the /var/lib/swarm-ca rule and the swarm.ca.* removals.
- deploy.bao.clientCaFile, deploy.bao.serverCaFile and
  deploy.swarm-controller.hiveClientCaFile naming /var/lib/swarm-ca or one
  of the deleted hive CA files fail evaluation, naming the store's mTLS CA
  (/var/lib/swarm-bao-pki/ca.pem on the store's host) as the replacement.

module-eval hive-tls covers the single-anchor bundle, the deletion (incl.
a relocated stateDir) and the assertion on all three options.

Refs #4588

docs/networking/gateway.md

@@ -80,7 +80,7 @@ The issuer is the **secret store's `pki` mount**, not a bare self-signed leaf. `
 
 **Why an issuer, not a bare leaf**: a bare self-signed leaf is its own trust anchor, so every regeneration is a new anchor every consumer must re-trust, and an agent's build sets its trust store once, before any leaf exists. Agents and federation peers trust the store's root once; leaf rotation never breaks them.
 
-**What consumers trust**: `trust-bundle.pem` in the same state dir. It carries the store's `pki` root, plus a hive CA's public `ca.pem` where one exists ([`swarm/ca.md`](../swarm/ca.md#the-trust-bundle)). nginx serves the leaf alone, since its issuer is a self-signed root. Agents (via `security.pki.certificateFiles`), the CI and forge containers and federating peers all read the bundle.
+**What consumers trust**: `trust-bundle.pem` in the same state dir. It carries the store's `pki` root ([`swarm/ca.md`](../swarm/ca.md#the-trust-bundle)). nginx serves the leaf alone, since its issuer is a self-signed root. Agents (via `security.pki.certificateFiles`), the CI and forge containers and federating peers all read the bundle.
 
 **Why on by default**: matrix-dart-sdk (FluffyChat's SDK) fetches `https://<host>/.well-known/matrix/client` and never falls back to plain http, so without TLS the browser client can't bootstrap.
 

docs/swarm/README.md

@@ -34,7 +34,7 @@ grafana, the controller, authelia, …) →
   contract → [`credentials.md`](credentials.md) · how the store comes up,
   who writes its grants and how it unseals → [`bao.md`](bao.md)
 - **swarm CA** — the store root every hive's gateway leaf chains to, and what to
-  hand a peer (`trust-bundle.pem`, never `ca.pem`). → [`ca.md`](ca.md)
+  hand a peer. → [`ca.md`](ca.md)
 - **snapshot store** — the swarm's one `btrfs receive` endpoint,
   `swarm.snapshotStore.{address,port}`. →
   [`snapshot-store.md`](../networking/snapshot-store.md)

docs/swarm/ca.md

@@ -75,21 +75,10 @@ issues it.
 ## The trust bundle
 
 `hive-tls-ca.service` writes `<deploy.hive-controller.tls.stateDir>/trust-bundle.pem`,
-the file every consumer anchors on. It holds whichever of these exist:
-
-- `swarm-services-root.pem`, the store's `pki` root, which the gateway leaf
-  and the swarm-services leaf both chain to.
-- `ca.pem` and `ca-previous.pem`: a hive CA's public certificates. Nothing
-  issues under that CA; they stay in the bundle so a leaf it signed verifies
-  until `hive-tls-resign` replaces it. Removing them is a deliberate later
-  step.
-
-No other anchor goes in: the store's `pki` root is the only root the swarm
-has.
-
-No hive generates a CA or signs with a CA key. A
-`<deploy.hive-controller.tls.stateDir>/ca-key.pem` stays on disk, unread:
-removing it comes with dropping `ca.pem` from the bundle.
+the file every consumer anchors on. It holds one certificate, a copy of
+`swarm-services-root.pem`: the store's `pki` root, which the gateway leaf and
+the swarm-services leaf both chain to. It's the only root the swarm has. Until
+the first fetch of that root lands, the bundle is empty.
 
 ⚠️ **A consumer reads its trust when it starts.** An agent or service
 container that last started before the store's root reached the bundle
@@ -164,9 +153,17 @@ role's `allowed_domains`, enforced by the store at issue time: a hive's
 identity that leaks can get certificates for that hive's names and no
 others.
 
-No hive holds a root CA or its key, and nothing under `/var/lib/swarm-ca`
-exists: every host deletes that directory at boot and on every deploy. The
-swarm distributes only certificates.
+No host holds a CA or its key, except the store's mTLS CA
+(`glue-bao-tls.nix`), which signs only the store's server certificate and the
+certificates that log in to it. At boot and on every deploy, every host
+deletes `/var/lib/swarm-ca` and the `ca.pem`, `ca-previous.pem` and
+`ca-key.pem` in `<deploy.hive-controller.tls.stateDir>`. The swarm distributes
+only certificates.
+
+A host whose `deploy.bao.clientCaFile`, `deploy.bao.serverCaFile` or
+`deploy.swarm-controller.hiveClientCaFile` names one of those paths fails
+evaluation. Those options name the store's mTLS CA,
+`/var/lib/swarm-bao-pki/ca.pem` on the host that runs the store.
 
 ## What to hand a peer