drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/agent-modules/queue-identity.nix

@@ -1,13 +1,11 @@
 # This agent's own credential for the swarm queue, read from the store by the
 # harness itself.
 #
-# The credential beside it in ./queue.nix is keyed per **hive**: one OIDC
-# client minted at deploy time and handed to every agent container on the
-# hive, so at the queue's auth callout one agent is indistinguishable from its
-# co-hived neighbours. This one is keyed per **agent** — `swarm-controller`
-# mints it at agent creation into `swarm/agents/<agent>/queue`
-# (`swarm_secret_client::queue::agent_queue_path`), at swarm level, with no
-# hive anywhere in the chain.
+# Keyed per **agent**, so at the queue's auth callout one agent is
+# distinguishable from its co-hived neighbours: `swarm-controller` mints it at
+# agent creation into `swarm/agents/<agent>/queue`
+# (`swarm_secret_client::queue::agent_queue_path`), at swarm level, with no hive
+# anywhere in the chain.
 #
 # The agent authenticates to the store as itself, with the certificate
 # ./bao.nix already proves it can log in with, and reads its own path. A hive
@@ -42,11 +40,7 @@ let
   # too.
   serverCaCredential = "hive-agent-bao-server-ca";
 
-  # The store's address is the whole switch, exactly as in ./bao.nix — and
-  # deliberately *not* the queue coordinates in ./queue.nix. Those are the
-  # hive's, and gating a swarm-minted per-agent credential on a hive-level
-  # option would put the hive back in a path whose entire purpose is not
-  # having one.
+  # The store's address is the whole switch, exactly as in ./bao.nix.
   configured = cfg.addr != null;
 in
 {
@@ -54,7 +48,7 @@ in
     systemd.services.hive-agent = {
       # A bare id, no path: the terse `LoadCredential=` form that inherits a
       # credential the service *manager* received, which is what the container
-      # manager passed in. ./bao.nix and ./queue.nix state the same shape.
+      # manager passed in. ./bao.nix states the same shape.
       serviceConfig.LoadCredential = [ serverCaCredential ];
       # The live certificate pair exists once ./bao.nix's unit has run.
       after = [ "hive-agent-bao-identity.service" ];