swarm: keep the webhook secret on read errors; surface hidden KV/auth/forge failures

- swarm-controller webhook: regenerate the secret only when the file is
  absent. Any other read error is returned with the path; the caller
  already logs "webhook secret unavailable" and the endpoint answers 503.
  Overwriting meant every registered hook kept the old secret and every
  delivery failed HMAC, with nothing re-registering them.
- swarm-queue-client wanted: open_read_only/watch return Result; only
  STREAM_NOT_FOUND on the bucket maps to None. hive-c0re's wanted pull
  fails the DAG node with the cause instead of logging "nothing has been
  declared"; the watch warns with the error chain.
- swarm-nats-auth: warn when the OIDC secret re-read task dies.
- swarm-controller forge: listing a repo's config PRs failing is warn,
  not debug.

Closes #5056

swarm-nats-auth/src/oidc_secret.rs

@@ -197,7 +197,18 @@ impl<S: Source> OidcSecret<S> {
             }
         });
         let handle = task.abort_handle();
-        let shared = task.map(|read| read.unwrap_or(false)).boxed().shared();
+        let shared = task
+            .map(|read| {
+                read.unwrap_or_else(|e| {
+                    tracing::warn!(
+                        error = %e,
+                        "the OIDC client secret re-read task died; keeping the one in use"
+                    );
+                    false
+                })
+            })
+            .boxed()
+            .shared();
         *slot = Some((handle, shared.clone()));
         shared
     }