swarm-builder, swarm-claude-login, swarm-review-classifier: forward each container's journal to the swarm collector

Each container now runs the journal forwarder the queue's container runs,
pushing to a receiver of its own on the swarm collector as the service's
existing OIDC client, with the client's secret read inside the container
by the fetch unit. Their store identities are system credentials, so the
fetch unit loads them too. The three containers drop --link-journal=host,
which hid their journals from the forwarder, and the host collector stops
reading them.

nix/host-modules/glue-builder-oidc-client.nix

@@ -28,6 +28,10 @@ in
         # `client_credentials`: a daemon authenticating as itself.
         kind = "machine";
         audience = [ clientId ];
+        # The container's journal forwarder mints its token as this client, for
+        # the swarm collector's receiver, which verifies it offline against
+        # `/jwks.json`; authelia's default opaque handle fails there.
+        accessTokenSignedResponseAlg = "RS256";
       }
     ];
   };