swarm-controller: harden the review classifier's real reviews

Follow-ups from the review of #5142.

A `Done` answer with fewer or more rows than the classifications sent, or
none, now posts the no-verdict comment instead of the classifier's overall
verdict, so a short answer can't approve.

Requests are accepted per repo, PR and head into a set bounded at the two
running plus eight waiting. A request for a key already running or waiting
starts nothing and logs at info; a request with every place taken starts no
run and posts a no-verdict comment saying so. Before, every delivery spawned
a task waiting on the semaphore, so toggling the review request queued one
paid run per toggle.

Table cells get a zero-width space after `#`, `!`, `://` and `www.`, so a
model's reason can't render an issue or PR reference or a bare URL as a link.

The secret publisher's policy denies the classifier's forge token leaf, the
way #5139 denied Grafana's admin password, with a module-eval-bao-grants arm
pinning it. The controller posts reviews with whatever token is there, so a
publisher write picked the account reviews come from.

Closes #5143, part of #5096.

nix/host-modules/swarm-bao.nix

@@ -489,6 +489,9 @@ let
   # Grafana's admin password is denied the same way: a write to it sets the
   # password `grafana.service` applies to the server-admin account at its next
   # start.
+  # The review classifier's forge token is denied too: the controller posts
+  # the classifier's reviews with whatever token is there, so a write to it
+  # picks the account those reviews come from.
   secretPublisherPolicyText = ''
     path "${credentialMountPath}/data/swarm/hives/*" {
       capabilities = ["create", "update"]
@@ -514,6 +517,10 @@ let
       capabilities = ["deny"]
     }
 
+    path "${credentialMountPath}/data/${classifierForgeTokenLeaf}" {
+      capabilities = ["deny"]
+    }
+
     path "${credentialMountPath}/data/${controllerClientLeaf}" {
       capabilities = ["create", "update"]
     }