hive-tls: bound each store attempt so a silent store fails into a retry

swarm-services-cert, swarm-services-cert-renew and hive-tls-resign are
oneshots, which systemd gives no start timeout, and the root-only
`ca/pem` curl set no connect or total timeout. A store that accepted the
connection and never answered held the attempt forever: no failure, so
no store-retry restart, and a hung renew unit swallowed every later
timer tick.

The curl now gives up after 10s to connect and 30s overall. Each unit
gets a TimeoutStartSec: 20min for the services-leaf pair (the script
waits up to 10min on its lock), 10min for the gateway leaf. The
`--no-block` comment no longer cites a TimeoutStartSec that did not
exist.

module-eval-hive-tls gains a case pinning both.

Closes #5303

nix/module-eval/hive-tls.nix

@@ -684,6 +684,18 @@ let
         && (t.timerConfig.Unit or "hive-tls-resign.service") == "hive-tls-resign.service"
         && !(remainsAfterExit leafUnit);
     }
+    {
+      # A oneshot has no start timeout by default, so an attempt that never
+      # ends never fails into a retry.
+      name = "every unit that calls the store bounds its attempt, and the root fetch bounds its curl";
+      ok =
+        lib.all (u: (u.serviceConfig.TimeoutStartSec or "infinity") != "infinity") [
+          boot
+          triggered
+          leafUnit
+        ]
+        && lib.hasInfix "--connect-timeout 10 --max-time 30" (noSvcBranch noSvcFetch);
+    }
   ];
 in
 runGroup "hive-tls" cases