github: PATs live in swarm bao; the agent fetches them itself

An operator links an agent's GitHub personal access token in the swarm UI
(LinkGithubAccountForm, "link github account" on /agents). swarm-controller's
PUT /api/hives/{hive}/agents/{agent}/github-account stores it at
swarm/agents/<agent>/github-token (swarm_secret_client::github), a flat leaf
under the agent's prefix that the agent's existing read grant already covers:
no policy change, and no list grant, since there is one token per agent.

In the agent, hive-agent-github-token (oneshot + 2-minute timer, as the agent
user, under its own store certificate, ordered before hive-github-notify)
reads that path and writes <state>/github-token, 0600 and agent-owned, the
file the gh wrapper, git credential helper and hive-github-notify already
read. It replaces the file by rename only when the bytes changed and never
deletes it: a hive-written github-token stays until a token is linked in the
swarm UI. It is installed only with a store address and
services.hyperhive.agent.github.enable.

Removed: the dashboard's CR3D3NTIALS page (credentials.html/js/css, its
build entries and H0M3 tile; GITHUB was its only tab), hive-c0re's
dashboard/matrix_accounts.rs with GET/POST /api/github-account,
priv_client::write_agent_github_token, the host socket's
SetAgentGithubToken and `hivectl github set-token`, and hive-priv's
WriteAgentGithubToken with write_agent_state_file, its only caller gone.

Docs: integrations/github.md and swarm/ui.md describe the swarm path,
swarm/credentials.md gains the store-path row, and the hive UI docs,
hivectl docs and security.md's hive-priv table drop the removed pieces.

Closes #4347

nix/module-eval/agent-github-bao.nix

@@ -0,0 +1,114 @@
+# `checks.module-eval-agent-github-bao` — see ./lib.nix for the shared
+# rationale (why this suite exists, naming convention, "evaluates
+# not executes").
+#
+# The agent side of the swarm-stored GitHub token: ../agent-modules/github-token.nix
+# fetches it into the file ../agent-modules/github.nix's readers use.
+{
+  pkgs,
+  lib,
+  self,
+  nixosSystem,
+}:
+let
+  inherit
+    (import ./lib.nix {
+      inherit
+        pkgs
+        lib
+        self
+        nixosSystem
+        ;
+    })
+    agentWith
+    runGroup
+    ;
+
+  baoAddr = "https://bao.t.local:8200";
+
+  # A store, and the integration on by default.
+  agentGithubBao = agentWith {
+    services.hyperhive.agent.bao.addr = baoAddr;
+  };
+
+  # No store: the absence arm, and what makes the cases above able to fail.
+  agentGithubNoBao = agentWith { };
+
+  # A store, and the integration switched off.
+  agentGithubOff = agentWith {
+    services.hyperhive.agent.bao.addr = baoAddr;
+    services.hyperhive.agent.github.enable = false;
+  };
+
+  fetchUnit = machine: machine.systemd.services.hive-agent-github-token;
+  has = machine: machine.systemd.services ? hive-agent-github-token;
+  hasTimer = machine: machine.systemd.timers ? hive-agent-github-token;
+in
+let
+  cases = [
+    {
+      name = "an agent with a store address and the integration on fetches its github token";
+      ok = has agentGithubBao && hasTimer agentGithubBao;
+    }
+    {
+      name = "an agent with no store address, or with the integration off, fetches none";
+      ok =
+        !(has agentGithubNoBao)
+        && !(hasTimer agentGithubNoBao)
+        && !(has agentGithubOff)
+        && !(hasTimer agentGithubOff);
+    }
+    {
+      # The nix half of `swarm_secret_client::github::account_path`, and the
+      # file ./github.nix's `gh` wrapper, credential helper and poller read.
+      name = "the fetch reads the agent's own github-token path into its state-dir file";
+      ok =
+        let
+          name = agentGithubBao.services.hyperhive.agent.user.name;
+          s = (fetchUnit agentGithubBao).script;
+        in
+        lib.hasInfix "bao kv get -format=json secret/swarm/agents/${name}/github-token >" s
+        && lib.hasInfix "token=/agents/${name}/state/github-token" s
+        && lib.hasInfix ".data.data.value | strings" s;
+    }
+    {
+      # The agent user owns its state dir (./user.nix), and the file keeps the
+      # `0600` it has always had.
+      name = "the fetch runs as the agent, with its own store identity";
+      ok =
+        let
+          u = fetchUnit agentGithubBao;
+          name = agentGithubBao.services.hyperhive.agent.user.name;
+        in
+        u.serviceConfig.User == name
+        && u.serviceConfig.UMask == "0077"
+        && builtins.elem "hive-agent-bao-cert" u.serviceConfig.LoadCredential
+        && builtins.elem "hive-agent-bao-key" u.serviceConfig.LoadCredential
+        && u.environment.BAO_ADDR == baoAddr
+        && u.environment.BAO_CLIENT_CERT == "%d/hive-agent-bao-cert"
+        && u.environment.BAO_CLIENT_KEY == "%d/hive-agent-bao-key";
+    }
+    {
+      # A file a hive wrote keeps working until the operator links a token in
+      # the swarm UI.
+      name = "the fetch never deletes the state-dir token, and swaps it in only on a change";
+      ok =
+        let
+          s = (fetchUnit agentGithubBao).script;
+        in
+        !(lib.hasInfix "rm -f \"$token\"" s)
+        && lib.hasInfix "cmp -s \"$staged\" \"$token\"" s
+        && lib.hasInfix "mv -f \"$staged\" \"$token\"" s;
+    }
+    {
+      # The poller reads the token once at start.
+      name = "the fetch runs before the github poller starts";
+      ok = builtins.elem "hive-github-notify.service" (fetchUnit agentGithubBao).before;
+    }
+    {
+      name = "the fetch re-runs every two minutes";
+      ok = agentGithubBao.systemd.timers.hive-agent-github-token.timerConfig.OnUnitInactiveSec == "2min";
+    }
+  ];
+in
+runGroup "agent-github-bao" cases