drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/module-eval/name-guards.nix

@@ -43,14 +43,12 @@ let
   # leaves, not a whole prefix, so a hive that inherited a dead entry there
   # would silently gain the ability to overwrite the swarm's matrix credential.
   #
-  # 🩸 The two per-hive subjects have a different shape: those roles are
-  # written PER HIVE, so the subject a hive must not be is
-  # `<prefix>-<some hive's name>` rather than the prefix itself. Reserving only
-  # the prefix would leave the composed spelling free, and a hive taking it
-  # would present a leaf the other hive's role accepts — a hive reading another
-  # hive's queue credential, the exact widening the split exists to avoid. The
-  # collision is with the OTHER hive's role, hence `other` beside `qr-other`
-  # and `hl-other`.
+  # 🩸 The per-hive subject has a different shape: that role is written PER
+  # HIVE, so the subject a hive must not be is `<prefix>-<some hive's name>`
+  # rather than the prefix itself. Reserving only the prefix would leave the
+  # composed spelling free, and a hive taking it would present a leaf the other
+  # hive's role accepts. The collision is with the OTHER hive's role, hence
+  # `other` beside `hl-other`.
   hiveNamedAfterEverySubject = hive {
     deploy.swarm-otel.enable = false;
     deploy.bao = {
@@ -62,7 +60,6 @@ let
       forwarderOidcCommonName = "fwctl";
       forgePublisherCommonName = "fpctl";
       granterCommonName = "grctl";
-      queueAgentCommonNamePrefix = "qr";
       hiveLeafCommonNamePrefix = "hl";
     };
     swarm.hives = {
@@ -75,7 +72,6 @@ let
       fpctl.domain = "fp.t.local";
       grctl.domain = "gr.t.local";
       other.domain = "other.t.local";
-      qr-other.domain = "q.t.local";
       hl-other.domain = "hl.t.local";
     };
   };
@@ -216,16 +212,9 @@ let
     {
       # 🩸 The per-hive half, and the one a prefix-only reservation would miss:
       # the role is `<prefix>-<hive>`, so the reserved string has to be composed
-      # against every declared hive. Here hive `qr-other` collides with the role
-      # written for hive `other` — a leaf that reads a credential belonging to a
-      # hive that is not it.
-      name = "a hive named after another hive's per-hive reader subject is refused";
-      ok = equalityGuardRefuses hiveNamedAfterEverySubject "qr-other";
-    }
-    {
-      # A hive taking this spelling would present a leaf hive `other`'s
-      # gateway-leaf role accepts, and could ask the store for that hive's
-      # certificate. The control is the legal roster below.
+      # against every declared hive. A hive taking this spelling would present
+      # a leaf hive `other`'s gateway-leaf role accepts, and could ask the store
+      # for that hive's certificate. The control is the legal roster below.
       name = "a hive named after another hive's gateway-leaf subject is refused";
       ok = equalityGuardRefuses hiveNamedAfterEverySubject "hl-other";
     }