hive-tls: the gateway leaf uses the services-issuer identity, not a hive's

swarm-services-cert issues the swarm-services leaf a self-signed gateway
serves, and on a host fronting no swarm name fetches the store's pki root.
It is gated on the gateway, not on a hive, yet its leaf pair was named
under deploy.hive-controller.tls and defaulted from the hive reader's cert
directory, and the root fetch presented the hive's own identity. A gateway
host with no hive had no such identity, so that branch was red by
construction.

- The pair moves to deploy.bao.servicesIssuerClient{Cert,Key}File, beside
  the store's other host-unit readers, and glue-bao-tls.nix defaults it on
  the store's host from the leaf it already mints. The old
  deploy.hive-controller.tls.baoClient{Cert,Key}File paths are
  mkRenamedOptionModule aliases. glue-services-issuer-bao-identity.nix,
  which derived the default from deploy.bao.clientCertFile, is gone.
- The no-swarm-name root fetch presents the services-issuer pair. The hive
  identity is now only hive-tls-resign's.
- A self-signed gateway with no pair fails evaluation, naming both options.
  A pair named but unreadable still fails the unit, naming the paths.

Refs #4921

nix/host-modules/glue-hive-tls-bao-identity.nix

@@ -6,7 +6,7 @@
 # that credential, which is what every hive on a host without the store does.
 #
 # ⚠️ The minting is NOT here. ./glue-bao-tls.nix holds the CA and signs the
-# leaf, for the reason ./glue-services-issuer-bao-identity.nix gives.
+# leaf, because the thing that owns a private key owns issuing from it.
 #
 # Gated on the minted PKI existing, as that file is, and on a hive running
 # here: a host without one has no hive leaf to ask for.
@@ -21,7 +21,7 @@ let
   baoDeploy = config.services.hyperhive.deploy.bao;
 
   # Where ./glue-bao-tls.nix puts the leaves, derived from the reader's own
-  # path as ./glue-services-issuer-bao-identity.nix derives it.
+  # path rather than repeating that file's directory literal.
   haveMintedPki = baoDeploy.clientCertFile != null;
   pkiDir = if haveMintedPki then builtins.dirOf baoDeploy.clientCertFile else null;
 in