drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

hive-c0re/src/meta.rs

@@ -455,12 +455,10 @@ const CANONICAL_INPUTS: &[&str] = &["nixpkgs"];
 /// trivial to stub from tests (which build their own slice instead of
 /// touching process-wide env).
 const FORWARDED_VARS: &[&str] = &[
-    // Where the swarm queue is and where its tokens are minted, as an agent
-    // container reaches them. Both are addresses the *host* computes — the
-    // queue's from the bridge IP an agent routes over, never a loopback
-    // address, which inside a container is the agent itself.
+    // Where the swarm queue is, as an agent container reaches it. An address
+    // the *host* computes, never a loopback address, which inside a container
+    // is the agent itself.
     "HIVE_AGENT_NATS_URL",
-    "HIVE_AGENT_OIDC_TOKEN_ENDPOINT",
     // Where the swarm secret store listens. The hive's own `BAO_ADDR` value,
     // forwarded under a separate name so the container never inherits the
     // hive's store environment wholesale — the address is the only part of it
@@ -470,7 +468,7 @@ const FORWARDED_VARS: &[&str] = &[
     // fetches to trust the swarm. Forwarded with the address, under the same gate.
     "HIVE_AGENT_BAO_SERVICES_PKI_MOUNT",
     // Where an agent's `swarm-logs` queries, computed by the host for the
-    // same reason as the two above: it is a gateway address, and a container
+    // same reason as the queue's: it is a gateway address, and a container
     // cannot derive it from anything it holds.
     "HIVE_AGENT_LOGS_QUERY_URL",
     // The metrics store's origin, for `swarm-metrics`, for the same reason.
@@ -494,18 +492,6 @@ const FORWARDED_VARS: &[&str] = &[
 /// name. Half-wiring this map is a value that evaluates fine and is silently
 /// wrong.
 const FORWARDED_VAR_OPTIONS: &[(&str, &str)] = &[
-    // Read at build time to decide whether the harness unit imports the hive's
-    // queue credential at all — see `nix/agent-modules/queue.nix`. Both halves
-    // wired for this map's own reason: an agent whose option says no queue and
-    // whose env says otherwise imports no credential for `swarm-logs`.
-    (
-        "HIVE_AGENT_NATS_URL",
-        "services.hyperhive.agent.queue.natsUrl",
-    ),
-    (
-        "HIVE_AGENT_OIDC_TOKEN_ENDPOINT",
-        "services.hyperhive.agent.queue.tokenEndpoint",
-    ),
     // Read at build time to decide whether the in-container identity check is
     // generated at all — see `nix/agent-modules/bao.nix`. Both halves wired
     // for this map's own reason: the unit bakes the address into its own
@@ -1561,35 +1547,22 @@ mod tests {
         );
     }
 
-    /// The queue coordinates travel as a pair and are wired through both
-    /// halves of the forwarded-var machinery: the env var the harness reads at
-    /// runtime and the option the harness *unit* is built from. An agent that
-    /// got only the env var would declare no credential and then report a
-    /// partial config — visible, but a rebuild away from working.
+    /// The queue address reaches the harness as env only. The agent module
+    /// declares no `services.hyperhive.agent.queue.*` option, so rendering one
+    /// into the meta flake fails every agent's evaluation.
     #[test]
-    fn queue_coordinates_are_forwarded_as_both_env_and_option() {
-        for var in ["HIVE_AGENT_NATS_URL", "HIVE_AGENT_OIDC_TOKEN_ENDPOINT"] {
+    fn queue_address_is_forwarded_as_env_and_no_option() {
+        assert!(FORWARDED_VARS.contains(&"HIVE_AGENT_NATS_URL"));
+        assert!(
+            !FORWARDED_VARS.contains(&"HIVE_AGENT_OIDC_TOKEN_ENDPOINT"),
+            "no agent reads a token endpoint"
+        );
+        for (var, option) in FORWARDED_VAR_OPTIONS {
             assert!(
-                FORWARDED_VARS.contains(&var),
-                "{var} must be forwarded into every agent's env"
+                !option.starts_with("services.hyperhive.agent.queue."),
+                "{var} renders {option}, which no agent module declares"
             );
         }
-        let mut out = String::new();
-        push_forwarded_var_options(
-            &mut out,
-            &[
-                ("HIVE_AGENT_NATS_URL", "nats://10.42.0.1:4222".to_string()),
-                (
-                    "HIVE_AGENT_OIDC_TOKEN_ENDPOINT",
-                    "https://auth.t.local/api/oidc/token".to_string(),
-                ),
-            ],
-        );
-        assert_eq!(
-            out,
-            "              services.hyperhive.agent.queue.natsUrl = \"nats://10.42.0.1:4222\";\n\
-             \x20             services.hyperhive.agent.queue.tokenEndpoint = \"https://auth.t.local/api/oidc/token\";\n"
-        );
     }
 
     /// `swarm-metrics` is installed only when the option is set, and reads