drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/module-eval/agent-queue-bao.nix

@@ -24,16 +24,13 @@ let
     agentHarness
     ;
 
-  # The agent side of the swarm queue. Both coordinates set is the only state
-  # in which the harness unit declares a credential at all, so the pair and
-  # the empty fixture beside it are the two arms worth having.
+  # An `agent.nix` still setting the queue coordinates the agent module no
+  # longer declares.
   agentQueue = agent {
     queue.natsUrl = "nats://10.42.0.1:4222";
     queue.tokenEndpoint = "https://auth.t.local/api/oidc/token";
   };
 
-  agentNoQueue = shared.agentBare;
-
   # The agent side of the swarm secret store. The address is the whole switch —
   # it is both what generates the login check and what that check points at —
   # so it and the empty fixture beside it are the two arms worth having.
@@ -106,21 +103,24 @@ let
       ok = swarmMetricsIn agentLogsNoBao == null && swarmMetricsIn agentLogs != null;
     }
     {
-      # Both ids or neither: the secret authenticates nobody without the id it
-      # belongs to, and `swarm-logs` reads both.
-      name = "an agent with queue coordinates imports both halves of its credential";
+      # The hive forwards no shared queue credential, so the harness unit
+      # names none, whatever the agent's config says.
+      name = "an agent imports no hive-shared queue credential";
       ok =
         let
-          c = (agentHarness agentQueue).serviceConfig.LoadCredential;
+          credentials = m: (agentHarness m).serviceConfig.LoadCredential or [ ];
         in
-        builtins.elem "hive-queue-agent-secret" c && builtins.elem "hive-queue-agent-client-id" c;
+        !lib.any (lib.hasPrefix "hive-queue-agent-") (credentials agentQueue ++ credentials agentBao)
+        # Control: the lookup finds the store identity's credential.
+        && lib.elem "hive-agent-bao-server-ca" (credentials agentBao);
     }
     {
-      # An agent built before its hive was handed the queue's address. It
-      # must declare nothing rather than name a credential that never
-      # arrives.
-      name = "an agent with no queue coordinates declares no credential";
-      ok = !((agentHarness agentNoQueue).serviceConfig ? LoadCredential);
+      # Both options are refused, naming where the address
+      # comes from now, rather than dropped silently.
+      name = "an agent setting the removed queue options is refused";
+      ok =
+        lib.count (a: !a.assertion && lib.hasInfix "HIVE_AGENT_NATS_URL" a.message) agentQueue.assertions
+        == 2;
     }
     {
       # The harness exits when it cannot reach the queue. It has to come back