drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/host-modules/swarm.nix

@@ -64,17 +64,14 @@ let
     deployCfg.bao.notifyRouterCommonName
     deployCfg.bao.forgePublisherCommonName
   ]
-  # The per-hive subjects, spelled out per hive rather than as the prefix.
+  # The per-hive subject, spelled out per hive rather than as the prefix.
   # The prefix alone would reserve the wrong string: the role for hive
   # `h` accepts `<prefix>-h`, so the name a hive must not BE is that composed
   # spelling, and a hive named it would present a leaf that role accepts.
   #
   # Every spelling is reserved for every declared hive, including the one the
-  # CN belongs to — a hive cannot be named after its own reader either.
-  ++ lib.concatMap (hive: [
-    "${deployCfg.bao.queueAgentCommonNamePrefix}-${hive}"
-    "${deployCfg.bao.hiveLeafCommonNamePrefix}-${hive}"
-  ]) hiveNames;
+  # CN belongs to — a hive cannot be named after its own leaf issuer either.
+  ++ map (hive: "${deployCfg.bao.hiveLeafCommonNamePrefix}-${hive}") hiveNames;
 
   # Public hostnames of the swarm's own services, in declaration order.
   # `serviceDomains` below is this set sorted + deduplicated.
@@ -477,9 +474,8 @@ in
   # its own network namespace and resolver, so this is its own option, even
   # though by name it defaults to the same URL as `statusPublish.natsUrl`.
   #
-  # Only the address lives here. The credential does not: it is published per
-  # hive and read out of the store by ./glue-queue-agent-credential.nix, which
-  # owns `queue.agentCredentialDir` in the same namespace.
+  # Only the address lives here. Each agent reads its own credential from the
+  # store (`nix/agent-modules/queue-identity.nix`).
   options.services.hyperhive.deploy.hive-controller.queue.agentNatsUrl = lib.mkOption {
     type = lib.types.nullOr lib.types.str;
     default = "tls://${swarmCfg.nats.domain}:${toString swarmCfg.nats.port}";
@@ -496,10 +492,8 @@ in
       agent's network namespace `127.0.0.1` is the agent, not this host,
       and the queue's certificate names no address anyway.
 
-      Null means this hive's agents have not been given the queue's address.
-      Together with
-      {option}`services.hyperhive.swarm.statusPublish.tokenEndpoint` it is
-      what decides whether the harness is handed queue coordinates at all.
+      Null means this hive's agents have not been given the queue's address,
+      and the harness is handed none.
     '';
   };