hive-tls: skip the store root fetch on a hive with no store identity

The `want_svc=0` root fetch presents `deploy.bao.clientCertFile`/
`clientKeyFile` to a listener that demands a client certificate. On a
hive with neither set, the handshake is refused every time, and
`swarm-services-cert` went from green to failed-and-retrying for 24h.

The branch is now chosen at eval: with no reader identity, the unit
logs that the store root was not staged and names the option, then
exits 0, and no fetch is rendered. A hive with an identity fetches as
before. `hivectl peer-config` already handles the absent file.

Refs #4588 (review c88774, point 2).

nix/module-eval/hive-tls.nix

@@ -46,6 +46,17 @@ let
   };
   noSvcFetch = noService.systemd.services.swarm-services-cert.script;
 
+  # The same hive with no reader identity at all.
+  noIdentity = hive { };
+  noIdFetch = noIdentity.systemd.services.swarm-services-cert.script;
+
+  # The `want_svc=0` branch of a rendered script, up to its closing `fi`.
+  noSvcBranch =
+    script:
+    builtins.head (
+      lib.splitString "\nfi\n" (lib.last (lib.splitString ''if [ "$want_svc" = 0 ]; then'' script))
+    );
+
   units = allLocal.systemd.services;
   boot = units.swarm-services-cert;
   timer = allLocal.systemd.timers.swarm-services-cert-renew;
@@ -147,6 +158,21 @@ let
           + " --key ${lib.escapeShellArg "/etc/pki/bao-client-key.pem"}"
         ) noSvcFetch;
     }
+    {
+      # Nothing to present means no fetch to fail: the unit stays green and
+      # says why the root is missing. The control is the same hive with an
+      # identity, whose branch does fetch and can fail.
+      name = "a hive fronting no swarm name with no store identity skips the fetch and cannot fail on it";
+      ok =
+        noIdentity.services.hyperhive.swarm.localServiceDomains == [ ]
+        && noIdentity.services.hyperhive.deploy.bao.clientCertFile == null
+        && !(lib.hasInfix "/v1/pki/ca/pem" noIdFetch)
+        && lib.hasInfix "store pki root not staged" (noSvcBranch noIdFetch)
+        && lib.hasInfix "deploy.bao.clientCertFile" (noSvcBranch noIdFetch)
+        && !(lib.hasInfix "exit 1" (noSvcBranch noIdFetch))
+        && lib.hasInfix "exit 1" (noSvcBranch noSvcFetch)
+        && lib.hasInfix "/v1/pki/ca/pem" (noSvcBranch noSvcFetch);
+    }
     {
       # The fetch retries against a sealed store; a gateway `Requires=` on it
       # would go down with each attempt. The control is a host fronting