swarm-matrix-ctl: one control binary for the matrix container, not one per job

Renames `swarm-matrix-minter` and reshapes it around subcommands. Minting
is now `swarm-matrix-ctl mint`.

Running rust inside `containers.hive-matrix` is not free: it needs its own
store identity, its own cert role and its own bind mounts, and every one of
those is per-*container*, not per-task. A second single-purpose crate would
have had to duplicate that plumbing to add one action, so the next thing
that has to run in there should be a verb here rather than a new crate.
The old name guaranteed the opposite.

`main.rs` is clap dispatch; the minting logic moves to `mint.rs` unchanged.
A bare invocation is refused: `mint` writes a credential, so "no verb"
defaulting to it would make a typo in the unit mint rather than fail.

The environment prefix moves with it, `MATRIX_MINTER_*` → `MATRIX_MINT_*`.
Scoped to the verb and not to the binary, because a binary-scoped prefix is
one the next verb has to share or widen, and a widened one never narrows
again. A test asserts every variable carries the verb's prefix.

The principal renames too. The cert role, bao policy, granting unit, leaf
filename and `certAuthCns` entry all have to spell one string the same way,
so leaving them as `swarm-matrix-minter` would have rebuilt the naming
split this branch exists to remove. Renaming the nix options alongside is
free here: every one of them is introduced by this PR and has never been
released, so no operator config names them yet.

`ExecStart` now names the verb, which is a contract between a nix string
and a clap enum that fails at deploy time with no local signal. Both ends
assert it: `mint_is_spelled_the_way_the_unit_invokes_it` in the crate, and
a new module-eval arm reading the rendered `ExecStart`.

docs/getting-started/setup.md drops the sender token from its "live on the
host" list: setup does not touch this credential, so a setup guide has no
reason to name it.

hive-c0re/src/matrix.rs

@@ -908,12 +908,12 @@ pub async fn sync_agent_standalone(name: &str) {
 /// and is non-empty.
 ///
 /// The token is taken from the **swarm secret store** when it is there:
-/// `swarm-matrix-minter`, the oneshot inside the matrix container, publishes
+/// `swarm-matrix-ctl`, the oneshot inside the matrix container, publishes
 /// it under an identity of its own, and taking it from there is what lets a
 /// hive that holds no `as_token` have an admin at all. The mint ladder below
 /// stays as the fallback for a store that is empty, unconfigured or
 /// unreachable — which is every swarm whose matrix container predates that
-/// minter.
+/// binary.
 pub async fn ensure_hive_user(client: &reqwest::Client, as_token: &str) -> Result<()> {
     use std::os::unix::fs::PermissionsExt;
     let path = sender_token_path();
@@ -996,19 +996,19 @@ fn persist_sender_token(path: &std::path::Path, access_token: &str) -> Result<()
     Ok(())
 }
 
-/// Fetch the sender token `swarm-matrix-minter` published, under
+/// Fetch the sender token `swarm-matrix-ctl` published, under
 /// this hive's own store identity.
 ///
 /// The cert role is the hive's name, straight out of `HYPERHIVE_HIVE_NAME` —
 /// the same role string `workers::credential` logs in with, and already in
 /// this process's environment, so the store read costs no plumbing through
 /// [`ensure_all`]. No new grant either: a hive's policy already covers the
-/// whole `swarm/services/*` tree the minter writes into.
+/// whole `swarm/services/*` tree `swarm-matrix-ctl` writes into.
 ///
 /// `None`, never an error, for every way this can come up empty — no hive
 /// name, no `BAO_*` identity, an unreachable store, nothing at the path. All
 /// four mean the same thing to the caller ("mint it the old way"), and three
-/// of them are the ordinary state of a swarm that has not deployed the minter
+/// of them are the ordinary state of a swarm that has not deployed `swarm-matrix-ctl`
 /// yet, so raising would turn a supported deployment into a warning every
 /// sweep.
 ///