drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/host-modules/hive-c0re/default.nix

@@ -333,8 +333,7 @@ in
           # from an unprivileged daemon without widening either.
           # The gate is the identity, never `deploy.bao.enable`: a hive that
           # reads a store on another machine holds one of these and runs no
-          # store. ./glue-queue-agent-credential.nix gates its own reader the
-          # same way.
+          # store. ../swarm-otel.nix gates its own reader the same way.
           lib.optionals baoClientIdentity [
             "bao-client.pem:${baoDeploy.clientCertFile}"
             "bao-client-key.pem:${baoDeploy.clientKeyFile}"

nix/host-modules/hive-c0re/environment.nix

@@ -11,9 +11,8 @@ let
   cfg = config.services.hyperhive.c0re;
   baoDeploy = config.services.hyperhive.deploy.bao;
   baoCfg = config.services.hyperhive.swarm.bao;
-  # The same test ../glue-queue-agent-credential.nix applies, and for the same
-  # reason: a reader is defined by holding a certificate the store accepts,
-  # not by sharing a host with the store. Deriving this from
+  # A reader is defined by holding a certificate the store accepts, not by
+  # sharing a host with the store. Deriving this from
   # `deploy.bao.enable` would be the co-location assumption itself.
   haveBaoClientIdentity = baoDeploy.clientCertFile != null && baoDeploy.clientKeyFile != null;
 in
@@ -222,31 +221,15 @@ in
       # the one the roster gave it.
       HIVE_C0RE_OIDC_CLIENT_ID = "hive-${config.services.hyperhive.hiveName}";
     }
-// {
-  # Where ../glue-queue-agent-credential.nix lands the AGENTS' queue
-  # credential. Read by `hive_c0re::lifecycle::host_config`, which stats the
-  # two files and forwards them into each container as systemd credentials.
-  # Never read for its contents here: the secret is `0600` root-owned and
-  # this daemon is `hive-core`, which is exactly why the transport is a
-  # credential rather than a bind mount.
-  HIVE_C0RE_AGENT_QUEUE_CREDENTIAL_DIR = toString config.services.hyperhive.deploy.hive-controller.queue.agentCredentialDir;
-}
 //
   # The agents' half of the same queue, forwarded by `hive_c0re::meta` into
-  # every container. A pair, gated together, because an agent that got one of
-  # them would report a half-configured queue instead of none.
+  # every container.
   #
   # ⚠️ By name, like `HIVE_C0RE_NATS_URL` above, and never a loopback
   # address: inside a container `127.0.0.1` is the agent itself.
-  lib.optionalAttrs
-    (
-      config.services.hyperhive.deploy.hive-controller.queue.agentNatsUrl != null
-      && config.services.hyperhive.swarm.statusPublish.tokenEndpoint != null
-    )
-    {
-      HIVE_AGENT_NATS_URL = config.services.hyperhive.deploy.hive-controller.queue.agentNatsUrl;
-      HIVE_AGENT_OIDC_TOKEN_ENDPOINT = config.services.hyperhive.swarm.statusPublish.tokenEndpoint;
-    }
+  lib.optionalAttrs (config.services.hyperhive.deploy.hive-controller.queue.agentNatsUrl != null) {
+    HIVE_AGENT_NATS_URL = config.services.hyperhive.deploy.hive-controller.queue.agentNatsUrl;
+  }
 //
   # Where an agent reads the swarm's logs. Gated on the store identity below,
   # because `swarm-logs` authenticates with the agent's own queue secret, read