swarm: keep the webhook secret on read errors; surface hidden KV/auth/forge failures

- swarm-controller webhook: regenerate the secret only when the file is
  absent. Any other read error is returned with the path; the caller
  already logs "webhook secret unavailable" and the endpoint answers 503.
  Overwriting meant every registered hook kept the old secret and every
  delivery failed HMAC, with nothing re-registering them.
- swarm-queue-client wanted: open_read_only/watch return Result; only
  STREAM_NOT_FOUND on the bucket maps to None. hive-c0re's wanted pull
  fails the DAG node with the cause instead of logging "nothing has been
  declared"; the watch warns with the error chain.
- swarm-nats-auth: warn when the OIDC secret re-read task dies.
- swarm-controller forge: listing a repo's config PRs failing is warn,
  not debug.

Closes #5056

swarm-controller/src/forge.rs

@@ -755,7 +755,7 @@ impl Client {
             {
                 Ok(prs) => prs,
                 Err(e) => {
-                    tracing::debug!(%agent, error = %e, "swarm forge: listing config PRs failed, skipping repo");
+                    tracing::warn!(%agent, error = %e, "swarm forge: listing config PRs failed, skipping repo");
                     continue;
                 }
             };