deploy: forward swarm.forge.ci to deploy.ci-runner, say what the forwarded enable needs

swarm.forge.ci.* were per-host options that 4423da48 had already moved to deploy.forgejo.ci.*, so they rename straight to deploy.ci-runner like the forgejo.ci ones; ciRunnerRemoved goes with its last caller.

The forwarded enable now trips deploy.ci-runner's store-identity assertion on a host with no deploy.bao.enable. The assertion names both options and the default, the doc states the requirement, and a module-eval case pins the refusal.

nix/host-modules/deploy.nix

@@ -32,32 +32,6 @@
 let
   deployCfg = config.services.hyperhive.deploy;
 
-  # A removed CI-runner option. Its replacement has the same name under
-  # `deploy.ci-runner`.
-  ciRunnerRemoved =
-    from: opt:
-    lib.mkRemovedOptionModule
-      (
-        [
-          "services"
-          "hyperhive"
-        ]
-        ++ from
-        ++ [ opt ]
-      )
-      ''
-        The CI runner is the swarm service in swarm-ci-runner.nix. It runs on
-        any host, needs neither the forge nor a hive there, and registers with
-        the token swarm-controller publishes to the secret store. Set
-        services.hyperhive.deploy.ci-runner.${opt} instead.
-
-        The runner registers as a new runner on the forge, so delete the old
-        one in the forge's admin panel (Site administration, Actions, Runners).
-        A forge host that runs the swarm-controller keeps resolving
-        `uses: actions/checkout` from itself unless
-        services.hyperhive.deploy.forgejo.actionsFromSelf is false there.
-        See docs/scheduler/ci.md.
-      '';
 in
 {
   imports = [
@@ -200,13 +174,28 @@ in
       [ "services" "hyperhive" "deploy" "ci-runner" "jobTimeout" ]
     )
 
-    # The `swarm.forge.ci` spellings fail evaluation and name the option under
-    # `deploy.ci-runner` to set instead.
-    (ciRunnerRemoved [ "swarm" "forge" "ci" ] "enable")
-    (ciRunnerRemoved [ "swarm" "forge" "ci" ] "name")
-    (ciRunnerRemoved [ "swarm" "forge" "ci" ] "concurrency")
-    (ciRunnerRemoved [ "swarm" "forge" "ci" ] "labels")
-    (ciRunnerRemoved [ "swarm" "forge" "ci" ] "package")
+    # The runner toggle sat under `swarm.forge.ci` before `deploy.forgejo.ci`.
+    # Both were per-host, so each forwards straight to its final path.
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "forge" "ci" "enable" ]
+      [ "services" "hyperhive" "deploy" "ci-runner" "enable" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "forge" "ci" "name" ]
+      [ "services" "hyperhive" "deploy" "ci-runner" "name" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "forge" "ci" "concurrency" ]
+      [ "services" "hyperhive" "deploy" "ci-runner" "concurrency" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "forge" "ci" "labels" ]
+      [ "services" "hyperhive" "deploy" "ci-runner" "labels" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "hyperhive" "swarm" "forge" "ci" "package" ]
+      [ "services" "hyperhive" "deploy" "ci-runner" "package" ]
+    )
 
     # The queue's callout identity. What stays under `swarm.nats` is what the
     # queue IS to every hive — the ports it answers on and the client id it is