hive-tls: the root fetch presents the hive identity, as on main

On a hive fronting no swarm name, swarm-services-cert's token-less
GET pki/ca/pem presents baoHiveIdentity{Cert,Key}File again. The fetch
never logs in and grants nothing; the client certificate only completes
the store listener's mTLS. A hive host without the store therefore needs
no copy of the services-issuer pair.

The issue path, which logs in to pki/issue/swarm-services, still presents
only deploy.bao.servicesIssuerClient{Cert,Key}File.

module-eval-hive-tls: the root-fetch cases pin the hive identity and the
absence of the services-issuer pair (a fixture holding both, and one
holding only the hive identity); the issue-path case pins the pair on a
hive host and on a host without a hive; a gateway without the pair
evaluates and its issue path names both options.

Root-fetch identity: option (a), mara on PR #5002 (comment 92591).

Refs #4921

docs/swarm/ca.md

@@ -39,10 +39,11 @@ from the store's own client CA, with the subject
   and set both options, before the host's next deploy.
 
 Without it, `hive-tls-resign.service` fails with a message naming both
-options. The unit checks the identity before the leaf, so it fails even while a
+options, and so does `swarm-services-cert.service` on a hive fronting no
+swarm name. The unit checks the identity before the leaf, so it fails even while a
 valid leaf keeps the gateway up. The identity is the hive's alone:
-it issues this hive's leaf and nothing else, and it's never the identity a
-swarm service uses.
+it issues this hive's leaf and fetches the store's root, and it's never the
+identity a swarm service uses.
 
 **When it issues.** The unit runs at boot, on every deploy, and from
 `hive-tls-resign.timer` once a day. It asks the store for a new leaf when
@@ -113,8 +114,10 @@ the services-issuer identity, calls
 copies from. The store's role, not a key on the host, decides which names a
 gateway can serve.
 
-**Every gateway that serves the self-signed leaf needs the services-issuer
-identity**, whether or not a hive runs on its host. It's a client certificate
+**Every self-signed gateway that fronts a swarm name needs the
+services-issuer identity**, whether or not a hive runs on its host. A hive
+fronting none needs no copy of it: it fetches the store's root with its own
+store identity, as below. It's a client certificate
 from the store's own client CA, with the subject
 `deploy.bao.servicesIssuerCommonName` (`swarm-services-issuer` by default),
 and it's named by `services.hyperhive.deploy.bao.servicesIssuerClientCertFile`
@@ -125,11 +128,11 @@ every gateway host:
 - On the host running the store, `swarm-bao-pki.service` mints it at
   `/var/lib/swarm-bao-pki/services-issuer.pem` and the two options default to
   it.
-- On every other gateway host, copy `services-issuer.pem` and
-  `services-issuer-key.pem` from the store's host and set both options.
+- On every other gateway host fronting a swarm name, copy
+  `services-issuer.pem` and `services-issuer-key.pem` from the store's host
+  and set both options.
 
-A host whose gateway serves the self-signed leaf without both options set
-still evaluates and deploys, and `swarm-services-cert.service` fails, naming
+A host fronting a swarm name without both options set still evaluates and deploys, and `swarm-services-cert.service` fails, naming
 them. One that names files it can't read fails the same unit, naming the
 paths. The old spellings,
 `deploy.hive-controller.tls.baoClientCertFile` and `baoClientKeyFile`, are
@@ -146,10 +149,12 @@ gateway can't serve a swarm service that runs behind another.
 
 **The root's public certificate is a file, on every self-signed gateway host:**
 `/var/lib/hive-tls/swarm-services-root.pem` (0644), written beside the
-leaf it signed and folded into `trust-bundle.pem`. A host fronting no
+leaf it signed and folded into `trust-bundle.pem`. A hive fronting no
 swarm name asks for no services leaf and reads the root alone, from the store's
-`pki/ca/pem`, presenting the services-issuer identity for the handshake
-without logging in with it. With either file absent,
+`pki/ca/pem`, presenting its own store identity
+(`deploy.hive-controller.tls.baoHiveIdentityCertFile` /
+`baoHiveIdentityKeyFile`) for the handshake without logging in with it.
+Every hive must hold one: without it, or with either file absent,
 `swarm-services-cert.service` fails with a message naming both options.
 On the host running
 the store it's also at