swarm-nats: grant agents their hive's terminal subject

The responder has had an agent arm since the principal was minted, but
no deployment ever passed `--agent-publish-subject`, and an empty list
is a refusal by design: `Policy::permissions` returns `None` rather than
a grant that can do nothing, so every agent was turned away at CONNECT.
The subject itself is the one this thread settled on, `$SWARM.term`
namespaced per hive.

The value has to reach the responder with a literal dollar. systemd
substitutes `$NAME` in `ExecStart` whether or not the word is quoted,
so a single dollar expands `SWARM` — unset, therefore empty — and the
responder is handed `.term.{hive}.>`. That grant validates (it carries
the `{hive}` placeholder), is accepted, and matches nothing any agent
publishes to, so the failure surfaces as an authorization violation far
from its cause. `$$` in the unit text is the escape for one dollar.

The module-eval case reads the rendered unit rather than the module
source, because the single-dollar version renders perfectly well; the
doubled dollar is the only thing that distinguishes them before deploy.

The grant is per-hive, not per-agent: an agent's identity names its
hive, so any agent in a hive can publish as another. That is the
tradeoff ruled acceptable for now, tracked separately for tightening.

Refs #3805

nix/host-modules/swarm-nats.nix

@@ -783,6 +783,16 @@ in
                 "--hive-client-prefix ${lib.escapeShellArg autheliaCfg.hiveClientPrefix}"
                 "--agent-client-suffix ${lib.escapeShellArg autheliaCfg.agentClientSuffix}"
                 "--reader-client ${lib.escapeShellArg controllerCfg.queueClientId}"
+                # What an agent may publish to, `{hive}` standing for the
+                # hive its client id names. Without it the responder has no
+                # agent grant to hand out and refuses every agent at CONNECT,
+                # so the terminal stream below depends on this line existing.
+                #
+                # `$$`, not `$`: systemd substitutes `$NAME` in `ExecStart`
+                # whether or not it is quoted, so a single dollar reaches the
+                # responder as the empty expansion of an unset `SWARM` and the
+                # grant silently becomes `.term.{hive}.>`.
+                "--agent-publish-subject ${lib.escapeShellArg "\$\$SWARM.term.{hive}.>"}"
               ];
               # Every credential arrives by `LoadCredential` and is named
               # on the command line only as a **path** — `argv` is