read the cache facts on the hive and let hives read the closure bucket

hive-c0re reads its cache facts from the store every five minutes and writes /run/hyperhive/attic/{netrc,substituter,public-key}, each 0600. it accepts only an https url, so the pull token never travels in clear. hives get a read grant on the agent-closures bucket, and swarm-queue-client a reader for it. part 2 of 3: nothing uses the files or the reader until the probe lands.

hive-c0re/src/swarm_status.rs

@@ -109,6 +109,9 @@ pub fn spawn(
             shutdown.clone(),
         ));
 
+        // The cache facts this hive pulls with, read into /run/hyperhive/attic.
+        tokio::spawn(crate::attic::reader::follow(shutdown.clone()));
+
         // The permissions the swarm grants, and the import of the meta repo's.
         tokio::spawn(crate::workers::swarm_permissions::follow(
             client.clone(),