read the cache facts on the hive and let hives read the closure bucket

hive-c0re reads its cache facts from the store every five minutes and writes /run/hyperhive/attic/{netrc,substituter,public-key}, each 0600. it accepts only an https url, so the pull token never travels in clear. hives get a read grant on the agent-closures bucket, and swarm-queue-client a reader for it. part 2 of 3: nothing uses the files or the reader until the probe lands.

hive-c0re/src/main.rs

@@ -16,6 +16,7 @@ use clap::{Parser, Subcommand};
 mod actions;
 mod agent_config;
 mod agent_set;
+mod attic;
 mod container_view;
 mod coordinator;
 mod dashboard;