swarm-nats: test that the server's rendered config carries the callout xkey

`checks.script-test-nats-render-config` runs the queue server's
`ExecStartPre` render against a scratch runtime directory: a fetched key
lands in `auth_callout.xkey` and the wrapper includes the fragment, and
a missing or malformed key file fails the start and writes no config.

module-eval only sees the render as a store path, so dropping `xkey`
from the template, or its substitution, passed every check while the
server would have run unsealed.

nix/script-tests/nats-render-config.sh

@@ -0,0 +1,60 @@
+# Cases for ./nats-render-config.nix. Each case gets a fresh runtime directory,
+# runs the rendered script against it, and asserts on the exit code and the
+# config files left behind.
+set -uo pipefail
+
+failures=0
+count=0
+
+fail() {
+  echo "FAILED: $case: $*" >&2
+  failures=$((failures + 1))
+}
+
+# The shape the script checks for, X and 55 base32 characters.
+key=XAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+
+setup() {
+  case=$1
+  dir=$(mktemp -d)
+  rt=$dir/rt
+  mkdir "$rt"
+  if ! sed "s|^d=.*|d=$rt|" "$RENDER" >"$dir/render"; then
+    echo "cannot read the rendered script $RENDER" >&2
+    exit 1
+  fi
+  chmod +x "$dir/render"
+  if ! grep -qxF "d=$rt" "$dir/render"; then fail "the rewrite did not reach the script's runtime directory"; fi
+}
+
+go() {
+  count=$((count + 1))
+  "$dir/render" >"$dir/out" 2>"$dir/err"
+  rc=$?
+}
+
+setup "a fetched key is rendered into auth_callout.xkey, and the server's config includes it"
+printf '%s' "$key" >"$rt/callout-xkey.pub"
+go
+if [ "$rc" -ne 0 ]; then fail "exit $rc: $(cat "$dir/err")"; fi
+if ! jq -e --arg k "$key" '.authorization.auth_callout.xkey == $k' "$rt/callout.conf" >/dev/null; then
+  fail "callout.conf does not carry the key as auth_callout.xkey"
+fi
+if ! grep -qxF 'include "callout.conf"' "$rt/nats.conf"; then fail "nats.conf does not include callout.conf"; fi
+
+setup "with no key file the start fails and writes no config"
+go
+if [ "$rc" -eq 0 ]; then fail "exited 0"; fi
+if [ -e "$rt/callout.conf" ] || [ -e "$rt/nats.conf" ]; then fail "a config was written"; fi
+
+setup "a file that is not a public xkey fails the start and writes no config"
+printf '%s' "not-a-key" >"$rt/callout-xkey.pub"
+go
+if [ "$rc" -eq 0 ]; then fail "exited 0"; fi
+if [ -e "$rt/callout.conf" ] || [ -e "$rt/nats.conf" ]; then fail "a config was written"; fi
+
+if [ "$failures" -ne 0 ]; then
+  echo "script-test-nats-render-config: $failures of $count cases broke" >&2
+  exit 1
+fi
+echo "$count cases hold in script-test-nats-render-config"