swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare

`swarm-bao-agent-pki` carried its own copy of the mtime-vs-start compare,
with the same `stat -c %.6Y | tr -d .` read: on a comma-locale host the
`-le` errored and, under `seal = "pkcs11"`, openbao was restarted on
every run of the unit.

The compare moves out of `refresh_unit` into `written_after_start`
(0 newer, 1 not newer, 2 unreadable and logged at `err`), and both
`refresh_unit` and the agent-pki unit call it. The agent-pki unit cannot
call `refresh_unit` itself: it restarts with `restart`, not
`try-restart`, runs a fail-closed check of the bundle between the
compare and the restart, and under shamir prints the step instead of
restarting. It acts only on 0, so an unreadable time skips the restart
as `refresh_unit` does.

`script-test-refresh-consumer` covers the three return codes in the
agent-pki call shape; `module-eval-bao-basics` asserts both seal arms
decide on that call and that no `%.6Y` read is left in the unit.

Refs #5230

nix/host-modules/swarm-bao.nix

@@ -3429,6 +3429,7 @@ in
             echo "wrote ${agentCaCachePath}"
           fi
 
+          ${refreshConsumer}
           ${composeListenerBundle}
           compose_listener_bundle
 
@@ -3437,11 +3438,12 @@ in
             echo "openbao in $machine is not running; it reads ${listenerClientCaPath} when it starts"
             exit 0
           fi
-          started="$(systemctl --machine="$machine" show --timestamp=us+utc -p ActiveEnterTimestamp --value openbao.service)"
-          started_us="$(date -u -d "$started" +%s%6N)"
-          written_us="$(stat -c %.6Y ${listenerClientCaPath} | tr -d .)"
-          if [ "$written_us" -le "$started_us" ]; then
+          newer=0
+          written_after_start openbao.service ${listenerClientCaPath} --machine="$machine" || newer=$?
+          if [ "$newer" = 1 ]; then
             echo "openbao started after ${listenerClientCaPath} last changed; nothing to pick up"
+          fi
+          if [ "$newer" != 0 ]; then
             exit 0
           fi