hive-matrix: load the swarm's appservice and promote its sender

The matrix container renders the swarm registration before tuwunel starts
(`requiredBy` it, no network), tuwunel loads it as a second `.yaml`
credential, and a publish unit hands its token to the store. tuwunel 1.9.1
refuses only a duplicate id or as_token, not overlapping non-exclusive
namespaces, so it sits beside the hive's `hyperhive` registration.

`admin_execute` promotes exactly `@swarm` at boot. The module-eval pin
narrows from "no account" to that one list, compared whole so a second
entry fails; `admin_execute_errors_ignore` is pinned too. matrix-ctl may
write the swarm token's leaf, and the controller may only read it.

Everything is gated on matrix-ctl's store identity: with nobody to publish
the token, the registration would be an admin credential nobody reads.

nix/host-modules/swarm-bao.nix

@@ -194,6 +194,10 @@ let
   # `read` too: `mint_and_verify` reads a credential back before writing so a
   # re-run keeps the value a live agent already holds instead of rotating it —
   # the read is required, not incidental.
+  #
+  # The swarm appservice token, read-only: the controller creates agents'
+  # matrix accounts with it and never writes it. matrix-ctl mints and publishes
+  # it (`matrixCtlPolicyText` below).
   controllerPolicyText = ''
     path "auth/cert/certs/hive-*" {
       capabilities = ["create", "update", "read", "delete"]
@@ -214,6 +218,10 @@ let
     path "${credentialMountPath}/data/swarm/agents/*" {
       capabilities = ["create", "read", "update"]
     }
+
+    path "${credentialMountPath}/data/${swarmAppserviceTokenLeaf}" {
+      capabilities = ["read"]
+    }
   '';
 
   # The identity that copies authelia's minted OIDC client secrets into the
@@ -278,10 +286,18 @@ let
   # restart would mint a second access token and invalidate the hive's. A read
   # here recovers one secret this principal itself wrote, which is a much
   # narrower grant than the publisher's would have been.
+  #
+  # The second stanza is the swarm appservice's token, which matrix-ctl mints
+  # inside the container and publishes here for the controller. `read` for the
+  # same reason: publish compares before it writes.
   matrixCtlPolicyText = ''
     path "${credentialMountPath}/data/swarm/hives/${matrixCtlHive}/matrix/sender-token" {
       capabilities = ["create", "update", "read"]
     }
+
+    path "${credentialMountPath}/data/${swarmAppserviceTokenLeaf}" {
+      capabilities = ["create", "update", "read"]
+    }
   '';
 
   # Which hive matrix-ctl mints for. This host's own by default, which is right
@@ -295,6 +311,12 @@ let
   # locally, which is the same degrade a store that was never deployed gives.
   matrixCtlHive = baoDeploy.matrixCtlHiveName;
 
+  # The swarm appservice token's leaf, the nix half of
+  # `swarm_secret_client::matrix::swarm_appservice_token_path`. Under
+  # `controller/`, the one kind no hive's policy reads: its sender is the
+  # homeserver's admin.
+  swarmAppserviceTokenLeaf = "swarm/controller/swarm-controller/matrix/appservice-token";
+
   # The KV v2 engine the controller writes agent credentials through. Named
   # once because the grant above and the `secrets enable` in the bootstrap unit
   # have to agree: a policy pointing at a mount nobody created is precisely the