glue: consumers' start-after-bao ordering moves into one glue module

Each store reader (forge's OIDC fetch and token publisher, matrix's OIDC
fetch, the hive collector's fetch, Grafana's OIDC fetch and admin password,
the queue's callout-xkey unit, the CI runner's token fetch, the swarm
collector's OIDC fetch) used to read `deploy.bao.enable` in its own module
to add `after`/`wants` on `container@<store machine>` and
`after`/`requires` on `swarm-bao-pki.service`. Per the #3742 ruling, that
cross-service read moves into glue-bao-readers-store-order.nix, which sets
the same edges when the store and the reader are both on this host and
restates each reader's own gate so no stub unit is rendered.

Rendered `after`/`wants`/`requires` are identical as sets to main on 16
fixtures, store here and elsewhere. New module-eval cases in existing
fixtures pin both arms.

Part of #3742.

nix/host-modules/swarm-nats.nix

@@ -830,15 +830,9 @@ in
     # responder's own leaf, the one principal that may create the keys' paths.
     systemd.services.swarm-bao-nats-callout-xkey = {
       description = "create the swarm queue's callout keys if absent and fetch their public halves for the server";
-      # The store's units exist only where the store runs; `Requires=` on an
-      # absent unit fails the job, so off-host the timeout below bounds the
-      # attempt instead.
-      after = lib.optionals baoDeploy.enable [
-        "swarm-bao-pki.service"
-        "container@${baoCfg.machine}.service"
-      ];
-      wants = lib.optionals baoDeploy.enable [ "container@${baoCfg.machine}.service" ];
-      requires = lib.optionals baoDeploy.enable [ "swarm-bao-pki.service" ];
+      # Ordered after the store where it runs here
+      # (./glue-bao-readers-store-order.nix); elsewhere the timeout below
+      # bounds the attempt.
       before = [ "container@${machine}.service" ];
       wantedBy = [
         "multi-user.target"