forward the attic container's journal to the swarm collector

nix/host-modules/swarm-bao.nix

@@ -1187,7 +1187,9 @@ let
 
   # The in-swarm cache's three secrets, create and read and nothing more: its
   # host units create each one only while it is absent, so none needs `update`,
-  # and a rewrite of a signing key or a token an operator holds is refused.
+  # and a rewrite of a signing key or a token an operator holds is refused. The
+  # cache container's journal forwarder reads its client secret under the same
+  # leaf.
   atticWriters = [
     {
       name = "swarm-attic";
@@ -1203,7 +1205,8 @@ let
             atticJwtLeaf
             atticPushTokenLeaf
             atticPullTokenLeaf
-          ];
+          ]
+        + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.attic.otel.clientId}/oidc/client";
     }
   ];