push ci run metrics to victoriametrics, with a grafana board

A swarm-ci-metrics host unit on a 5-minute timer lists every forge
repo's Actions runs as the new read-only ci-metrics account and pushes
each finished run's duration and queue wait over OTLP, stamped at the
run's stop time. The first pass backfills from run 1. swarm-controller
mints the account's token into bao and keeps a ci-metrics team with
read on the Actions unit in every organisation.

Closes #5376

nix/host-modules/swarm-secret-publisher.nix

@@ -108,6 +108,8 @@ let
     hyperhiveCfg.swarm.matrix.otel.clientId
     # The metrics store container's journal forwarder, whose host reads it.
     hyperhiveCfg.swarm.victoriametrics.otel.clientId
+    # The CI run poller, which reads it itself on its host.
+    hyperhiveCfg.swarm.ci-metrics.clientId
   ];
 
   # The swarm controller's OIDC client, which it reads back from the store