swarm-bao: give the store forwarder's OIDC reader its own bao identity

`swarm-bao-forwarder-oidc` fetches the store container's collector secret,
one path, and was the last reader still logging in with
`deploy.bao.clientCertFile`: the hive's own leaf, whose policy reads every
agent's credentials, the hive's tree and every service's OIDC secret. The
four-way split gave grafana's and the swarm collector's readers leaves of
their own and left this one behind.

It now holds `forwarder-oidc.pem`, minted by `swarm-bao-pki`, and logs in
under the `swarm-forwarder-oidc` cert-auth role, whose policy reads
`secret/data/swarm/services/<store forwarder client id>/oidc/client` and
nothing else. The role is written by `swarm-bao-forwarder-oidc-policy`
from the bootstrap token, which gains the two grants that unit calls, and
the reader is ordered after it. The subject is reserved as a hive name. A
store host whose pair is null is refused at eval rather than falling back
to the hive's leaf.

The hive's own role and `client.pem` are untouched; nothing is revoked.

nix/host-modules/glue-bao-readers-policy-order.nix

@@ -44,6 +44,9 @@ let
     swarm-bao-otel-oidc =
       deployCfg.swarm-otel.enable
       && havePair baoDeploy.otelOidcClientCertFile baoDeploy.otelOidcClientKeyFile;
+    # ./swarm-bao.nix: its block is gated on the store, which `orderAfterPolicy`
+    # already checks.
+    swarm-bao-forwarder-oidc = hyperhiveCfg.enable;
     # ./swarm-nats.nix: the queue's TLS leaf, not a secret, but the same wait.
     swarm-bao-nats-tls = deployCfg.nats.enable;
   };