swarm: courier an agent's store identity into its container, and log in with it

`swarm-controller` mints an agent's mTLS leaf at creation and publishes it
at `swarm/agents/<agent>/bao-mtls`. Nothing read it back. This adds the
hop that carries it the rest of the way, and the in-container consumer
that proves the hop works.

Host side, `lifecycle::agent_identity` reads the row under *this hive's*
own certificate — the hive is a principal the store already knows — and
stages the leaf and its key `0600` under a new `agent-identity/<name>`
state dir, deliberately outside every bind-mounted tree. Both files go in
as systemd credentials rather than binds, the same answer and the same
mode reason as the queue secret beside it: the staged key is unreadable
to the unprivileged agent user, and the container manager reads a
`--load-credential` source as root before re-exposing it under the
consuming unit's own `User=`. The agent is never asked to authenticate in
order to obtain the thing it authenticates with.

Container side, `hive-agent-bao-identity.service` logs in with that
certificate and reads the agent's own path back, failing the unit when
either step does not succeed. It fails loudly where the hive-side readers
degrade quietly, because a refused certificate means an agent that
believes it reaches the store and never does — a cause only the login
itself can name.

The address is the whole switch, no separate `enable`, matching how
`queue.nix` and `logs.nix` already gate themselves. A hive with a store
forwards `HIVE_AGENT_BAO_ADDR` and every agent on it gets the check; a
hive without one forwards nothing and no agent does. That is what keeps
the delivery from landing in a container with nothing to read it.

The hive can now reach an agent's identity, so hive privilege covers
agent privilege. Accepted, not mitigated: the alternative is an agent
fetching its own credential with a credential it does not yet have.

Refs #4137

nix/host-modules/hive-c0re/environment.nix

@@ -334,6 +334,12 @@ in
   # handshake, naming neither.
   lib.optionalAttrs haveBaoClientIdentity {
     BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
+    # The same address again under an agent-facing name, forwarded into every
+    # container's module block by `meta::render_flake`. Deliberately not the
+    # `BAO_ADDR` line itself: a container that inherited this hive's store
+    # environment wholesale would inherit the hive's certificate paths with it,
+    # and those name a credential no agent may present.
+    HIVE_AGENT_BAO_ADDR = "https://${baoCfg.domain}:${toString baoCfg.port}";
     # `%d`, not the paths themselves: the key is `0600` root-owned and this
     # daemon runs as hive-core, so it never gets read access to the original.
     # See the LoadCredential in ./default.nix.