nix: run the review classifier in a container of its own when a host enables it

deploy.review-classifier.enable (off by default, not derived from
allSwarmServices) puts swarm-review-classifier in its own network
namespace on the bridge, with claude-code and the daemon. A host unit
copies the classifier's store leaf into the container; the daemon reads
its queue client secret and the API key from the store with it.

- glue-bao-tls mints the review-classifier leaf; swarm-bao writes the
  swarm-review-classifier role, reading exactly the API key path and the
  classifier's queue client secret; swarm.nix reserves its CN.
- glue-review-classifier-oidc-client registers the machine client where
  authelia runs, and the publisher carries its secret to the store.
- swarm-nats passes the client id to the responder as
  --review-classifier-client.
- Where the host runs a hive-tier collector, claude exports its metrics
  there; the daemon adds the repo and the PR to the resource attributes.
- module-eval: the new grant and leaf (bao-grants, now sixteen granting
  units), the container's presence and its unit (core-toggle), and the
  client registration and publishing (secret-publisher).

nix/host-modules/swarm-bao.nix

@@ -932,6 +932,19 @@ let
     }
   ];
 
+  # The review classifier: the API key the operator writes, read once per run,
+  # and its own queue client secret, read at start. Both by the daemon inside
+  # its container.
+  reviewClassifierReaders = [
+    {
+      name = "swarm-review-classifier";
+      cn = baoDeploy.reviewClassifierCommonName;
+      policyText =
+        readStanza "${credentialMountPath}/data/swarm/services/review-classifier/anthropic-api-key"
+        + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.review-classifier.clientId}/oidc/client";
+    }
+  ];
+
   # The forge host's one store identity. `swarm-bao-forge-publisher` writes
   # the controller's forge token under it, the one writer of that path and
   # write-only: it copies a file in and never reads one back.
@@ -1754,6 +1767,20 @@ in
       '';
     };
 
+    reviewClassifierCommonName = lib.mkOption {
+      type = lib.types.str;
+      default = "swarm-review-classifier";
+      description = ''
+        Subject the store's `swarm-review-classifier` cert-auth role accepts:
+        the identity the review classifier presents from inside its
+        container. Its grant is two paths, read only:
+        `swarm/services/review-classifier/anthropic-api-key` and its own
+        queue client secret.
+
+        ⚠️ Reserved as a hive name by ./swarm.nix, like its siblings.
+      '';
+    };
+
     forgePublisherCommonName = lib.mkOption {
       type = lib.types.str;
       default = "swarm-forge-publisher";
@@ -2003,6 +2030,32 @@ in
       '';
     };
 
+    reviewClassifierClientCertFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/var/lib/swarm-bao-pki/review-classifier.pem";
+      description = ''
+        Certificate the review classifier presents to the store. Its subject
+        must be
+        {option}`services.hyperhive.deploy.bao.reviewClassifierCommonName`.
+
+        ./glue-bao-tls.nix points it at the leaf it mints on the store's host.
+        On a classifier host without the store, it is a file the operator
+        copies from the store's host. A path, never a value.
+      '';
+    };
+
+    reviewClassifierClientKeyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/var/lib/swarm-bao-pki/review-classifier-key.pem";
+      description = ''
+        Private key for
+        {option}`services.hyperhive.deploy.bao.reviewClassifierClientCertFile`.
+        A path, never a value.
+      '';
+    };
+
     forgePublisherClientCertFile = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
@@ -3074,6 +3127,8 @@ in
 
       systemd.services.swarm-bao-ci-runner-policy = readerPolicyUnit "write the CI runner's registration-token-reader bao policy and cert-auth role" ciRunnerReaders;
 
+      systemd.services.swarm-bao-review-classifier-policy = readerPolicyUnit "write the review classifier's API-key-reader bao policy and cert-auth role" reviewClassifierReaders;
+
       systemd.services.swarm-bao-forge-publisher-policy = readerPolicyUnit "write the forge's controller-token-publisher bao policy and cert-auth role" forgePublisherWriters;
 
       # A FOURTH sibling, same shape and same reasons as the two above. This