drop the shared hive agent login

Every agent now connects to the queue and reads logs with its own secret
from the store (#5181), so the per-hive `hive-<h>-agent` OIDC client has
no reader left. Remove it end to end:

- hive-c0re no longer forwards `hive-queue-agent-{secret,client-id}` into
  containers, and no longer forwards HIVE_AGENT_OIDC_TOKEN_ENDPOINT; the
  agent module that loaded them (nix/agent-modules/queue.nix) is gone, its
  options refused with a removal message.
- The host reader (glue-queue-agent-credential.nix, swarm-bao-queue-agent),
  its store role and policy unit (swarm-bao-queue-agent-policy), its PKI
  leaf and the deploy.bao.queueAgent* / queue.agentCredentialDir options
  are gone; the options are refused with a removal message.
- authelia mints no `hive-<h>-agent` client, and swarm-secret-publish no
  longer writes swarm/hives/<h>/queue/agent.
- swarm-secret-client drops queue::agent_client_path / queue::Credential.
- HIVE_AGENT_NATS_URL is now gated on the agents' queue address alone.

The log store's authelia check stays for operators. swarm-nats-auth still
refuses a `-agent` client id; that refusal and `agentClientSuffix` are left
for a follow-up.

Refs #4459
Refs #4765

nix/module-eval/secret-publisher.nix

@@ -80,7 +80,6 @@ let
       # Each hive's hive-c0re reads this exact path
       # (`swarm_secret_client::queue::hive_client_path`, pinned by that crate's
       # own test), for every hive in the roster, not only the one this host is.
-      # The agents' client beside it stays a separate path.
       name = "the publisher writes every hive's own client under that hive's prefix";
       ok =
         let
@@ -91,8 +90,7 @@ let
           [
             "h1"
             "h2"
-          ]
-        && lib.hasInfix "secret/swarm/hives/h1/queue/agent" s;
+          ];
     }
     {
       # The controller reads this exact path
@@ -333,17 +331,17 @@ let
         lib.hasInfix "value=@" code && !(lib.hasInfix "$(cat" code);
     }
     {
-      # Two ends of a wire nothing at eval time carries end to end: this is the
-      # path `swarm_secret_client::queue` resolves for the reader. Both hives
-      # are asserted, so a publisher that knew one name rather than the roster
-      # fails here rather than on the second hive ever added to a swarm.
-      name = "the publisher writes every hive in the roster to that hive's own queue path";
+      # No hive holds a shared queue credential for its agents, so authelia
+      # mints no agent client and the publisher writes no such path. The
+      # control: the same script writes each hive's own client.
+      name = "the publisher writes no hive-shared agent queue credential";
       ok =
         let
           s = (inAuthelia secretPublisherHere).systemd.services.swarm-secret-publish.script;
         in
-        lib.hasInfix "secret/swarm/hives/h1/queue/agent" s
-        && lib.hasInfix "secret/swarm/hives/h2/queue/agent" s;
+        !(lib.hasInfix "/queue/agent" s)
+        && !(lib.hasInfix "-agent.secret" s)
+        && lib.hasInfix "secret/swarm/hives/h1/oidc/client" s;
     }
     {
       # A property of the SET, not of one unit: both of these authenticate by
@@ -373,7 +371,7 @@ let
             && !(lib.hasInfix "bao kv" (lib.head (lib.splitString "bao login" c)));
         in
         holdsTokenFirst (inAuthelia secretPublisherHere).systemd.services.swarm-secret-publish.script
-        && holdsTokenFirst baoWithMatrix.systemd.services.swarm-bao-queue-agent.script
+        && holdsTokenFirst baoWithMatrix.systemd.services.swarm-bao-matrix-oidc.script
         # Controls, so a clean verdict above means something. In order: a bare
         # read is refused, a read placed before the login is refused, and a
         # login that exists only in a comment is refused — that last one is the