swarm-bao granter stops retrying a rejected bootstrap token

swarm-bao-granter-role exits 4 when the store is unsealed but refuses the
bootstrap token, and Restart=on-failure retried that every 30s for as long
as the token file existed. RestartPreventExitStatus=4 makes that permanent
failure leave the unit failed once. Exit 1 (store sealed or unreachable)
keeps retrying.

On deploy: the unit goes red once instead of looping every 30s. The stale
token on muede-lpt2 still needs the operator step (remove it or mint a
fresh one); this does not clear it.

nix/host-modules/swarm-bao.nix

@@ -3135,6 +3135,9 @@ in
           RemainAfterExit = true;
           Restart = "on-failure";
           RestartSec = 30;
+          # Exit 4 is a refused bootstrap token, which retrying cannot fix:
+          # the unit stays failed until the operator replaces the token.
+          RestartPreventExitStatus = "4";
           TimeoutStartSec = 60;
           # Runs only once the script above exits 0, which is when the
           # granter may first configure `auth/oidc`; the viewer unit exits 0

nix/module-eval/bao-grants.nix

@@ -1154,6 +1154,16 @@ let
         && u.serviceConfig.Restart == "on-failure"
       ) grantingUnitNames;
     }
+    {
+      # Exit 4 is the refused-token path, which no retry can fix; exit 1 (store
+      # sealed or unreachable) stays retried.
+      name = "the granter's unit stays failed on exit 4 and retries other failures";
+      ok =
+        let
+          sc = baoGrantHere.systemd.services.swarm-bao-granter-role.serviceConfig;
+        in
+        sc.RestartPreventExitStatus == "4" && sc.Restart == "on-failure";
+    }
     {
       # Every reader and granting unit's start pulls the PKI unit in, so a mass
       # container start outruns systemd's default limit of 5 starts in 10s.