drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/host-modules/deploy.nix

@@ -53,6 +53,14 @@ let
     puts it there. Remove this definition; the file it named is read by
     nothing now and can be deleted.
   '';
+
+  # Shared by the removed options of the hive's agent queue credential reader.
+  queueAgentCredentialRemoved = ''
+    A hive no longer fetches a shared queue credential for its agents: each
+    agent reads its own secret from the swarm's secret store under its own
+    certificate. Remove this definition; the leaf or directory it named is read
+    by nothing now and can be deleted.
+  '';
 in
 {
   imports = [
@@ -95,6 +103,35 @@ in
       "statusPublish"
       "clientSecretFile"
     ] statusSecretRemoved)
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "deploy"
+      "bao"
+      "queueAgentCommonNamePrefix"
+    ] queueAgentCredentialRemoved)
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "deploy"
+      "bao"
+      "queueAgentClientCertFile"
+    ] queueAgentCredentialRemoved)
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "deploy"
+      "bao"
+      "queueAgentClientKeyFile"
+    ] queueAgentCredentialRemoved)
+    (lib.mkRemovedOptionModule [
+      "services"
+      "hyperhive"
+      "deploy"
+      "hive-controller"
+      "queue"
+      "agentCredentialDir"
+    ] queueAgentCredentialRemoved)
 
     # Same type, same meaning, new path — so a rename carries it exactly
     # and existing configs keep evaluating with one warning naming both