swarm: keep the webhook secret on read errors; surface hidden KV/auth/forge failures

- swarm-controller webhook: regenerate the secret only when the file is
  absent. Any other read error is returned with the path; the caller
  already logs "webhook secret unavailable" and the endpoint answers 503.
  Overwriting meant every registered hook kept the old secret and every
  delivery failed HMAC, with nothing re-registering them.
- swarm-queue-client wanted: open_read_only/watch return Result; only
  STREAM_NOT_FOUND on the bucket maps to None. hive-c0re's wanted pull
  fails the DAG node with the cause instead of logging "nothing has been
  declared"; the watch warns with the error chain.
- swarm-nats-auth: warn when the OIDC secret re-read task dies.
- swarm-controller forge: listing a repo's config PRs failing is warn,
  not debug.

Closes #5056

swarm-queue-client/src/lib.rs

@@ -118,6 +118,22 @@ pub enum Error {
         source: async_nats::jetstream::context::CreateKeyValueError,
     },
 
+    #[cfg(feature = "kv")]
+    #[error("opening the {bucket} bucket")]
+    OpenBucket {
+        bucket: String,
+        #[source]
+        source: async_nats::jetstream::context::KeyValueError,
+    },
+
+    #[cfg(feature = "kv")]
+    #[error("watching key {key}")]
+    WatchKey {
+        key: String,
+        #[source]
+        source: async_nats::jetstream::kv::WatchError,
+    },
+
     #[cfg(feature = "notices")]
     #[error("creating the {stream} stream")]
     CreateStream {