drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/agent-modules/default.nix

@@ -34,6 +34,12 @@ let
     sets it. Pin it host-side with
     services.hyperhive.deploy.hive-controller.claudeCodePackage.
   '';
+  queueRemoved = ''
+    The harness reads the queue's address at runtime from HIVE_AGENT_NATS_URL,
+    which the hive forwards into every container, and authenticates with the
+    agent's own secret from the swarm secret store, so no agent build sets a
+    queue option. Remove the setting.
+  '';
 
   # `claude` on PATH. A hive that pins a claude-code
   # (`services.hyperhive.deploy.hive-controller.claudeCodePackage`) hands its
@@ -81,7 +87,6 @@ in
     ./otel.nix
     ./otel-removed.nix
     ./packages.nix
-    ./queue.nix
     ./queue-identity.nix
     ./user.nix
     ./screen.nix
@@ -101,6 +106,8 @@ in
       "agent"
       "claudeCodePath"
     ] claudeCodePathRemoved)
+    (lib.mkRemovedOptionModule [ "services" "hyperhive" "agent" "queue" "natsUrl" ] queueRemoved)
+    (lib.mkRemovedOptionModule [ "services" "hyperhive" "agent" "queue" "tokenEndpoint" ] queueRemoved)
   ];
 
   options.services.hyperhive.agent.icon = lib.mkOption {