nix: ship the journals of the units an apply can leave failed

The units on the path a deploy takes to TLS, the store's grants and the
swarm collector itself were not on the host collector's journald
allowlist, so an ingest outage one of them caused showed in the store
only as every source going quiet at once.

Each module names its own units, per the option's rule:
- hive-tls.nix: hive-tls-ca, swarm-services-cert
- hive-gateway: hive-gateway-self-signed-cert (self-signed mode only)
- swarm-bao.nix: the seven grant units beside
  swarm-bao-services-issuer-policy
- swarm-otel.nix: container@<machine>, and
  nixos-rebuild-switch-to-configuration, the transient unit nixos-rebuild
  runs the activation in and whose syslog lines carry its status

The module-eval arm pins each unit as both listed and defined, since a
listed name that matches nothing is silent.

nix/host-modules/swarm-bao.nix

@@ -1500,7 +1500,7 @@ in
       # addresses on every command.
       environment.systemPackages = [ baoCli ];
 
-      # The in-container unit plus the two host-side ones this module defines.
+      # The in-container unit plus the host-side ones this module defines.
       # `swarm-bao-pki` and `swarm-bao-matrix-token` are declared by the glue
       # modules that create them, per the option's own rule — and a name
       # nothing defines is silently ignored, so naming them from here would
@@ -1510,6 +1510,13 @@ in
         "swarm-bao-certs"
         "swarm-bao-token"
         "swarm-bao-forwarder-oidc"
+        "swarm-bao-controller-policy"
+        "swarm-bao-secret-publisher-policy"
+        "swarm-bao-matrix-ctl-policy"
+        "swarm-bao-matrix-token-policy"
+        "swarm-bao-queue-agent-policy"
+        "swarm-bao-grafana-oidc-policy"
+        "swarm-bao-otel-oidc-policy"
         "swarm-bao-services-issuer-policy"
       ];