read the cache facts on the hive and let hives read the closure bucket

hive-c0re reads its cache facts from the store every five minutes and writes /run/hyperhive/attic/{netrc,substituter,public-key}, each 0600. it accepts only an https url, so the pull token never travels in clear. hives get a read grant on the agent-closures bucket, and swarm-queue-client a reader for it. part 2 of 3: nothing uses the files or the reader until the probe lands.

hive-c0re/src/attic/mod.rs

@@ -0,0 +1,4 @@
+//! The swarm's binary cache, as this hive sees it: the pull credentials it is
+//! given ([`reader`]).
+
+pub mod reader;