read the cache facts on the hive and let hives read the closure bucket

hive-c0re reads its cache facts from the store every five minutes and writes /run/hyperhive/attic/{netrc,substituter,public-key}, each 0600. it accepts only an https url, so the pull token never travels in clear. hives get a read grant on the agent-closures bucket, and swarm-queue-client a reader for it. part 2 of 3: nothing uses the files or the reader until the probe lands.

docs/swarm/builder.md

@@ -358,7 +358,7 @@ the swarm at an existing tenant:
    `secret/swarm/services/attic/pull-token`, with read rights on that cache.
 3. Seed the three facts hives pull with, each as field `value`:
    `secret/swarm/services/attic/url` (`https://` and the host, no trailing
-   slash), `secret/swarm/services/attic/cache` (the cache's name) and
+   slash; hives refuse `http://`), `secret/swarm/services/attic/cache` (the cache's name) and
    `secret/swarm/services/attic/public-key` (`<name>:<base64>`, from the
    cache's page or `attic cache info`). The controller copies the leaves that
    exist.
@@ -383,6 +383,12 @@ leaves (`pull-token`, `url`, `cache`, `public-key`) to
 own prefix. It writes a copy only when the value differs, skips a leaf the
 store doesn't hold, and leaves a copy whose source disappeared.
 
+`hive-c0re` reads its four leaves every five minutes under the hive's own store
+identity and writes `/run/hyperhive/attic/netrc`, `substituter` and
+`public-key` (tmpfs, each `0600`). It accepts only an `https` URL, since the
+token goes out in a header and in the netrc; a hive that finds another scheme
+writes nothing. No deploy reads the files yet: deploys still build locally.
+
 ## Credentials
 
 | What                    | Where                                             | Who reads it                                       |