nix: run the review classifier in a container of its own when a host enables it

deploy.review-classifier.enable (off by default, not derived from
allSwarmServices) puts swarm-review-classifier in its own network
namespace on the bridge, with claude-code and the daemon. A host unit
copies the classifier's store leaf into the container; the daemon reads
its queue client secret and the API key from the store with it.

- glue-bao-tls mints the review-classifier leaf; swarm-bao writes the
  swarm-review-classifier role, reading exactly the API key path and the
  classifier's queue client secret; swarm.nix reserves its CN.
- glue-review-classifier-oidc-client registers the machine client where
  authelia runs, and the publisher carries its secret to the store.
- swarm-nats passes the client id to the responder as
  --review-classifier-client.
- Where the host runs a hive-tier collector, claude exports its metrics
  there; the daemon adds the repo and the PR to the resource attributes.
- module-eval: the new grant and leaf (bao-grants, now sixteen granting
  units), the container's presence and its unit (core-toggle), and the
  client registration and publishing (secret-publisher).

nix/module-eval/secret-publisher.nix

@@ -227,6 +227,22 @@ let
         secretPublisherHere.systemd.services.swarm-secret-publish.script
       );
     }
+    {
+      # The review classifier reads its queue client secret from the store
+      # inside its container; authelia registers it on every IdP host.
+      name = "the review classifier's client is registered as a machine, and the publisher carries its secret";
+      ok =
+        let
+          c = lib.findFirst (
+            c: c.id == "swarm-review-classifier"
+          ) null secretPublisherHere.services.hyperhive.swarm.authelia.oidc.clients;
+        in
+        c != null
+        && c.kind == "machine"
+        && lib.hasInfix "secret/swarm/services/swarm-review-classifier/oidc/client" (
+          secretPublisherHere.systemd.services.swarm-secret-publish.script
+        );
+    }
     {
       # The store's UI login: authelia registers the client with the callback
       # the store's `oidc` role allows, and the publisher carries its secret