swarm-secret-publish: drop RemainAfterExit so the path unit re-runs it

swarm-secret-publish.service was Type=oneshot with RemainAfterExit=true.
After its first successful run it stayed active (exited), so every later
start from swarm-secret-publish.path (PathChanged on authelia's client
secret dir) was a no-op: a secret minted or replaced after that first run
never reached the store, and nothing logged it.

Without RemainAfterExit the unit goes inactive after each run, so each
PathChanged event starts a fresh publish. Same shape as
swarm-bao-forge-publisher in hive-forge/default.nix. No unit requires,
wants, orders after, binds to or is part of swarm-secret-publish.service,
so nothing depended on it staying active.

This also covers the first-boot race where the publisher runs before
authelia's first mint: the mint writes the file, and the path unit now
starts the publisher again.

A module-eval case pins it: the path unit targets the service, the
service is a oneshot, and RemainAfterExit is unset or false.

Closes #5032

nix/module-eval/secret-publisher.nix

@@ -379,6 +379,20 @@ let
         && !(m.systemd.services ? swarm-secret-publish)
         && !(m.systemd.paths ? swarm-secret-publish);
     }
+    {
+      # The path unit's start is a no-op while its target is `active (exited)`,
+      # so a secret minted after the first run would never be published.
+      # `Type` is read too, so a missing `serviceConfig` cannot pass the arm.
+      name = "the publisher's path unit starts a oneshot that does not remain active";
+      ok =
+        let
+          m = secretPublisherHere;
+          sc = m.systemd.services.swarm-secret-publish.serviceConfig;
+        in
+        m.systemd.paths.swarm-secret-publish.pathConfig.Unit == "swarm-secret-publish.service"
+        && sc.Type == "oneshot"
+        && !(sc.RemainAfterExit or false);
+    }
   ];
 in
 runGroup "secret-publisher" cases