matrix: the agent's daemon pulls its linked accounts from bao itself

hive-matrix-daemon now learns which external matrix accounts it has from
the swarm secret store, under the agent's own certificate, and the hive
push chain for matrix is gone.

The daemon lists swarm/agents/<agent>/matrix/ (the `list` its policy
grants on its own metadata subtree), reads each account's homeserver
from its credential, and brings the accounts up with their tokens from
the store. Every two minutes it lists again and exits with 75 when the
set of linked accounts changed; the unit restarts on 75 without counting
a failure. A listed name whose credential reads as absent is skipped and
logged once. At start it removes the matrix-token-<a> /
matrix-account-<a>.json pairs a hive delivered (a sidecar marks a pair
as delivered; a declared tokenFile keeps its token).

Removed: CredentialNotice and the $SWARM.credential.* subject and NATS
grant, the controller's publish and its queue precondition on the PUT
route, hive-c0re's credential subscription arm and workers/credential.rs,
priv_client::write_agent_matrix_token, hive-priv's WriteAgentMatrixToken
and its helpers, and the daemon's state-dir account discovery.

Kept: WriteAgentGithubToken and the external-forge path
(WriteAgentExtraForgeAccount, extra_forges.rs) are untouched, and a
declared matrixAccounts tokenFile is still read when the store has no
token for that account.

Refs #4348

hive-c0re/src/lifecycle/agent_identity.rs

@@ -94,9 +94,7 @@ enum Skipped {
 async fn collect(agent: &str, dir: &Path) -> Result<(), Skipped> {
     // The hive's name is the cert-auth role it logs in as: `glue-bao-tls.nix`
     // mints this host's client certificate with the hive name as its CN and a
-    // bao cert role matches on CN, so the two share a name by construction —
-    // the same reasoning `swarm_status::handle_credential_notice` records for
-    // the other read this hive does on an agent's behalf.
+    // bao cert role matches on CN, so the two share a name by construction.
     let Some(hive) = crate::container_view::hive_swarm_names().0 else {
         return Err(Skipped::NotConfigured(
             "HYPERHIVE_HIVE_NAME is unset, so this hive has no role to log in as",