drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/host-modules/swarm-otel.nix

@@ -232,12 +232,11 @@ let
   haveCollectorSecret = deployCfg.swarm-otel.clientSecretFile != null;
 
   # A reader of the store is defined by holding a certificate the store
-  # accepts, never by standing next to it — the rule
-  # ./glue-queue-agent-credential.nix states in full. Unlike Grafana's identical-
+  # accepts, never by standing next to it — the rule ./swarm-bao.nix's
+  # `deploy.bao` options block states in full. Unlike Grafana's identical-
   # looking flag, this one does not gate an assertion on its own: the
-  # store-reading unit below simply does not render without it, the same choice
-  # ./glue-queue-agent-credential.nix makes for its own reader, because a collector with no client identity is
-  # `haveCollectorSecret = false` above, and that is already a supported,
+  # store-reading unit below simply does not render without it, because a
+  # collector with no client identity is `haveCollectorSecret = false` above, and that is already a supported,
   # merely degraded shape rather than a service with no way in at all. What
   # IS asserted is narrower and lives in `assertions` below — see
   # `hiveReaderIdentity`.
@@ -539,7 +538,7 @@ in
     # exists so a host holds ONE out-of-band secret — its client certificate —
     # and reads everything else with it. Recorded in docs/swarm/secrets.md.
     #
-    # Shaped after ./glue-queue-agent-credential.nix: a cert login that fails
+    # Shaped after ./swarm-grafana.nix's store reader: a cert login that fails
     # LOUDLY, since every state it fails on is one a retry fixes, then a read
     # that degrades QUIETLY, since no retry turns "no value there" into a
     # value.