swarm-bao: agent certificates issued by a store-generated agent CA

An agent's store identity was signed in swarm-controller's memory by a CA
a controller-host unit generated on disk, and the listener never trusted
that CA. Agent leaves now come from the store itself: a `pki-agents` PKI
mount whose root openbao generates internally, so the agent CA's key
never exists outside the store.

- swarm-bao-agent-pki (new, store host, as the bao granter): enables and
  tunes the mount, generates the root once (guarded on an empty issuer
  list, no replace branch), upserts the `swarm-agent` role (client
  certificates named `hive-agent-*` only, 90 days), caches the CA at
  /var/lib/swarm-bao-tls/agent-ca.pem and composes the listener bundle.
- The listener's tls_client_ca_file is a new listener-client-ca.pem
  (client-ca.pem, then the agent CA). Host cert-auth roles still pin
  client-ca.pem, so an agent leaf satisfies no host role. swarm-bao-certs
  composes the same bundle before openbao starts.
- openbao reads tls_client_ca_file only at start, so when the bundle
  changed after openbao started, swarm-bao-agent-pki restarts
  openbao.service in the container; under `seal = "shamir"` it prints
  the step instead. Once swarm-bao-certs has a cached CA, later boots
  start openbao with it and do not restart.
- The controller policy gains exactly `update` on
  pki-agents/issue/swarm-agent. mint_and_verify now asks that role for
  the leaf (the store generates the key), writes the agent's cert-auth
  role pinning the issuing CA bao returned, and writes the agent's
  policy as render_agent alone: the hive-shared queue credential stanza
  is gone.
- deploy.bao.agentPkiRoleName (must start `swarm-`, asserted with the
  other pki role names); swarm-controller gets
  SWARM_CONTROLLER_AGENT_PKI_MOUNT/_ROLE from the deploy.bao options.

Deleted: swarm-controller-agent-ca and its options (agentCaFile,
agentCaKeyFile), env, LoadCredential entries and assertion;
agent_identity's Authority, rcgen signing and validity window; the
rcgen and time dependencies of swarm-controller (rcgen leaves the
workspace); policy::render_agent_with_queue and its tests. The CN-prefix
assertion policy.rs said was owed is not: agent and host roles pin
different CAs.

Migration is re-creating each agent after deploy; that overwrites the
stale role and policy.

Closes #4756

swarm-secret-client/src/forge.rs

@@ -17,7 +17,7 @@ use crate::{
 ///
 /// A flat leaf under the agent's prefix, like its controller-minted siblings
 /// [`crate::queue::agent_queue_path`] and [`crate::mtls::identity_path`], so
-/// the agent's own read stanza ([`crate::policy::render_agent_with_queue`])
+/// the agent's own read stanza ([`crate::policy::render_agent`])
 /// already covers it.
 ///
 /// # Errors
@@ -89,7 +89,7 @@ mod tests {
         // policy is rendered elsewhere. If the path ever moved out from under
         // it, the agent's fetch would 403 at boot, naming neither.
         let path = agent_token_path("atlas").expect("legal");
-        let policy = crate::policy::render_agent_with_queue("atlas", "pr1ma").expect("legal");
+        let policy = crate::policy::render_agent("atlas").expect("legal");
         let covered = policy.lines().any(|line| {
             line.strip_prefix("path \"")
                 .and_then(|rest| rest.split_once("\" {"))
@@ -104,7 +104,7 @@ mod tests {
         // Control for the test above: the prefix match must actually be
         // discriminating, or it proves nothing.
         let path = agent_token_path("atlas").expect("legal");
-        let policy = crate::policy::render_agent_with_queue("argus", "pr1ma").expect("legal");
+        let policy = crate::policy::render_agent("argus").expect("legal");
         let covered = policy.lines().any(|line| {
             line.strip_prefix("path \"")
                 .and_then(|rest| rest.split_once("\" {"))