swarm: courier an agent's store identity into its container, and log in with it

`swarm-controller` mints an agent's mTLS leaf at creation and publishes it
at `swarm/agents/<agent>/bao-mtls`. Nothing read it back. This adds the
hop that carries it the rest of the way, and the in-container consumer
that proves the hop works.

Host side, `lifecycle::agent_identity` reads the row under *this hive's*
own certificate — the hive is a principal the store already knows — and
stages the leaf and its key `0600` under a new `agent-identity/<name>`
state dir, deliberately outside every bind-mounted tree. Both files go in
as systemd credentials rather than binds, the same answer and the same
mode reason as the queue secret beside it: the staged key is unreadable
to the unprivileged agent user, and the container manager reads a
`--load-credential` source as root before re-exposing it under the
consuming unit's own `User=`. The agent is never asked to authenticate in
order to obtain the thing it authenticates with.

Container side, `hive-agent-bao-identity.service` logs in with that
certificate and reads the agent's own path back, failing the unit when
either step does not succeed. It fails loudly where the hive-side readers
degrade quietly, because a refused certificate means an agent that
believes it reaches the store and never does — a cause only the login
itself can name.

The address is the whole switch, no separate `enable`, matching how
`queue.nix` and `logs.nix` already gate themselves. A hive with a store
forwards `HIVE_AGENT_BAO_ADDR` and every agent on it gets the check; a
hive without one forwards nothing and no agent does. That is what keeps
the delivery from landing in a container with nothing to read it.

The hive can now reach an agent's identity, so hive privilege covers
agent privilege. Accepted, not mitigated: the alternative is an agent
fetching its own credential with a credential it does not yet have.

Refs #4137

hive-c0re/src/meta.rs

@@ -706,6 +706,11 @@ const FORWARDED_VARS: &[&str] = &[
     // address, which inside a container is the agent itself.
     "HIVE_AGENT_NATS_URL",
     "HIVE_AGENT_OIDC_TOKEN_ENDPOINT",
+    // Where the swarm secret store listens. The hive's own `BAO_ADDR` value,
+    // forwarded under a separate name so the container never inherits the
+    // hive's store environment wholesale — the address is the only part of it
+    // an agent may have, the certificate beside it being the hive's own.
+    "HIVE_AGENT_BAO_ADDR",
     // Where an agent's `swarm-logs` queries, computed by the host for the
     // same reason as the two above: it is a gateway address, and a container
     // cannot derive it from anything it holds.
@@ -747,6 +752,12 @@ const FORWARDED_VAR_OPTIONS: &[(&str, &str)] = &[
         "HIVE_AGENT_OIDC_TOKEN_ENDPOINT",
         "services.hyperhive.agent.queue.tokenEndpoint",
     ),
+    // Read at build time to decide whether the in-container identity check is
+    // generated at all — see `nix/agent-modules/bao.nix`. Both halves wired
+    // for this map's own reason: the unit bakes the address into its own
+    // environment, so an agent whose option says no store and whose env says
+    // otherwise would have a check that is simply not there.
+    ("HIVE_AGENT_BAO_ADDR", "services.hyperhive.agent.bao.addr"),
     // Read at build time to decide whether `swarm-logs` is installed at all —
     // see `nix/agent-modules/logs.nix`. Both halves wired for this map's own
     // reason: an agent whose option says no log store and whose env says