swarm-secret-client: render a hive's read policy, and refuse names that inject

The controller writes an agent's credential; the hive reads it back with its
own token. Nothing says which paths that token may read, so the read half of
a delivery has no identity at all and answers 403.

This is the pure half of the fix: the policy text is a function of a hive name
and its agent set, so the shape can be asserted with no store to talk to.

One stanza per hosted agent rather than a prefix grant. An agent's credential
path does not name the hive hosting it -- deliberately, since agents migrate --
so "this hive's agents" has no prefix expression and must be enumerated. The
grant is read-only: the controller mints these and never reads one back.

The paths come from MOUNT and AGENT_PREFIX rather than literals, so the policy
cannot drift from the module that builds the paths it grants.

checked_segment runs before any name reaches HCL. That is policy injection
rather than path traversal -- a name can close a stanza and open a wider one --
so the test carries a real injection string, paired with the reachable-charset
control that stops it passing by refusing everything.

An empty agent set renders an empty policy, which grants nothing.

swarm-secret-client/src/lib.rs

@@ -8,6 +8,11 @@
 //! ([`matrix`]). Each of those is a thing the controller and a hive must say
 //! identically, so it is said once here.
 //!
+//! [`policy`] is the same kind of agreement seen from the other side: which of
+//! those paths a hive's own token may read. It belongs here rather than in the
+//! controller because the grant and the path are one statement — spelled
+//! differently they produce a 403 that names neither.
+//!
 //! [`client`] is deliberately ignorant of all of it: it moves whatever type a
 //! caller names, so a second kind of secret is a new module beside [`matrix`]
 //! and not another field on a struct shared with it.
@@ -15,6 +20,7 @@
 pub mod client;
 pub mod matrix;
 pub mod path;
+pub mod policy;
 
 pub use client::SecretStore;