push ci run metrics to victoriametrics, with a grafana board

A swarm-ci-metrics host unit on a 5-minute timer lists every forge
repo's Actions runs as the new read-only ci-metrics account and pushes
each finished run's duration and queue wait over OTLP, stamped at the
run's stop time. The first pass backfills from run 1. swarm-controller
mints the account's token into bao and keeps a ci-metrics team with
read on the Actions unit in every organisation.

Closes #5376

nix/host-modules/swarm-bao.nix

@@ -449,6 +449,10 @@ let
       capabilities = ["create", "read", "update"]
     }
 
+    path "${credentialMountPath}/data/${ciMetricsForgeTokenLeaf}" {
+      capabilities = ["create", "read", "update"]
+    }
+
     path "${credentialMountPath}/data/${swarmAppserviceTokenLeaf}" {
       capabilities = ["read"]
     }
@@ -504,8 +508,8 @@ let
   # The review classifier's forge token is denied too: the controller posts
   # the classifier's reviews with whatever token is there, so a write to it
   # picks the account those reviews come from.
-  # So is the builder's: a write to it picks the account the builder fetches
-  # config repos as.
+  # So are the builder's and the CI run poller's: a write to either picks the
+  # account that service reads the forge as.
   secretPublisherPolicyText = ''
     path "${credentialMountPath}/data/swarm/hives/*" {
       capabilities = ["create", "update"]
@@ -539,6 +543,10 @@ let
       capabilities = ["deny"]
     }
 
+    path "${credentialMountPath}/data/${ciMetricsForgeTokenLeaf}" {
+      capabilities = ["deny"]
+    }
+
     path "${credentialMountPath}/data/${controllerClientLeaf}" {
       capabilities = ["create", "update"]
     }
@@ -620,6 +628,12 @@ let
   # to fetch config repos.
   builderForgeTokenLeaf = "swarm/services/builder/forge/token";
 
+  # The CI run poller's forge token, the nix half of
+  # `swarm_secret_client::ci_metrics::forge_token_path`. The controller mints it
+  # and reads it back before deciding whether to re-mint; the poller reads it
+  # to list runs.
+  ciMetricsForgeTokenLeaf = "swarm/services/ci-metrics/forge/token";
+
   # The review classifier's ACP provider key, the nix half of
   # `swarm_secret_client::review_classifier::acp_provider_key_path`. Written
   # and read like the API key above.
@@ -1095,6 +1109,18 @@ let
     }
   ];
 
+  # The CI run poller: its forge token and its own OIDC client secret, both
+  # read once per pass by the host unit.
+  ciMetricsReaders = [
+    {
+      name = "swarm-ci-metrics";
+      cn = baoDeploy.ciMetricsCommonName;
+      policyText =
+        readStanza "${credentialMountPath}/data/${ciMetricsForgeTokenLeaf}"
+        + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.ci-metrics.clientId}/oidc/client";
+    }
+  ];
+
   # The claude login minter: every agent's `claude-credentials` leaf,
   # create and update so a relogin replaces the last, and nothing else under
   # an agent; and its own queue client secret, read at start.
@@ -2003,6 +2029,19 @@ in
       '';
     };
 
+    ciMetricsCommonName = lib.mkOption {
+      type = lib.types.str;
+      default = "swarm-ci-metrics";
+      description = ''
+        Subject the store's `swarm-ci-metrics` cert-auth role accepts: the
+        identity the CI run poller presents from its host unit. Its grant is
+        two paths, read only: `swarm/services/ci-metrics/forge/token` and its
+        own OIDC client secret.
+
+        ⚠️ Reserved as a hive name by ./swarm.nix, like its siblings.
+      '';
+    };
+
     claudeLoginCommonName = lib.mkOption {
       type = lib.types.str;
       default = "swarm-claude-login";
@@ -2318,6 +2357,31 @@ in
       '';
     };
 
+    ciMetricsClientCertFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/var/lib/swarm-bao-pki/ci-metrics.pem";
+      description = ''
+        Certificate the CI run poller presents to the store. Its subject must
+        be {option}`services.hyperhive.deploy.bao.ciMetricsCommonName`.
+
+        ./glue-bao-tls.nix points it at the leaf it mints on the store's host.
+        On a poller host without the store, it is a file the operator copies
+        from the store's host. A path, never a value.
+      '';
+    };
+
+    ciMetricsClientKeyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/var/lib/swarm-bao-pki/ci-metrics-key.pem";
+      description = ''
+        Private key for
+        {option}`services.hyperhive.deploy.bao.ciMetricsClientCertFile`.
+        A path, never a value.
+      '';
+    };
+
     claudeLoginClientCertFile = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
@@ -3435,6 +3499,8 @@ in
 
       systemd.services.swarm-bao-builder-policy = readerPolicyUnit "write the swarm builder's forge-token-reader bao policy and cert-auth role" builderReaders;
 
+      systemd.services.swarm-bao-ci-metrics-policy = readerPolicyUnit "write the CI run poller's forge-token-reader bao policy and cert-auth role" ciMetricsReaders;
+
       systemd.services.swarm-bao-claude-login-policy = readerPolicyUnit "write the claude login minter's credentials-writer bao policy and cert-auth role" claudeLoginWriters;
 
       systemd.services.swarm-bao-forge-publisher-policy = readerPolicyUnit "write the forge's controller-token-publisher bao policy and cert-auth role" forgePublisherWriters;