hive CA: delete ca.pem, ca-previous.pem and ca-key.pem, the bundle is the store's root

The gateway leaf comes from the store's pki mount, so a hive CA's
certificates anchor nothing and its key is a secret outside the store.

- hive-tls-ca writes trust-bundle.pem from swarm-services-root.pem alone;
  the ca.pem and ca-previous.pem slots are gone.
- Every host deletes ca.pem, ca-previous.pem and ca-key.pem in
  deploy.hive-controller.tls.stateDir with tmpfiles `r` rules that follow
  the option. The removal shim, now host-ca-removed.nix, holds these
  beside the /var/lib/swarm-ca rule and the swarm.ca.* removals.
- deploy.bao.clientCaFile, deploy.bao.serverCaFile and
  deploy.swarm-controller.hiveClientCaFile naming /var/lib/swarm-ca or one
  of the deleted hive CA files fail evaluation, naming the store's mTLS CA
  (/var/lib/swarm-bao-pki/ca.pem on the store's host) as the replacement.

module-eval hive-tls covers the single-anchor bundle, the deletion (incl.
a relocated stateDir) and the assertion on all three options.

Refs #4588

nix/host-modules/lib/hive-ca-trust.nix

@@ -33,11 +33,8 @@ let
   # `gateway.useSelfSigned` is the single source of truth for the
   # self-signed condition — no duplicated derivation.
   useSelfSigned = gatewayCfg.useSelfSigned;
-  # The bundle, not `ca.pem`: the hive CA is an intermediate under the
-  # swarm root, and openssl (which is what both consumers below sit on —
-  # Node's `NODE_EXTRA_CA_CERTS`, Go's `SSL_CERT_FILE`) will not end a
-  # chain at a trusted cert that isn't self-signed. `hive-tls.nix` writes
-  # the bundle next to the CA and explains the split.
+  # The bundle `hive-tls.nix` writes: the store's `pki` root, which the
+  # gateway's leaf chains to.
   caHostPath = "${tlsCfg.stateDir}/trust-bundle.pem";
   caContainerPath = "/run/hive-ca/trust-bundle.pem";