swarm-builder: build each agent config PR head and post a commit status

A new `swarm-builder` service, in its own container on the host that sets
`deploy.builder.enable` (defaulted on by `allSwarmServices` where the host
has the builder's store leaf, like the review classifier).

When an `agent-configs/<agent>` PR is opened, reopened or synchronized,
swarm-controller queues a `build_agent` jobq node. The node sets a
`swarm-builder` commit status to pending on the PR head, sends
`{agent, rev, pr}` to the builder over NATS request-reply
(`$SWARM.builder.build`), and writes success (store path), failure (last
line nix printed) or error (no builder / no reply) on the head. The node
fails when the build does, so the Jobs page matches the PR.

The builder builds nix/builder/check-flake's `check` with every input
overridden: hyperhive and nixpkgs to the host's own
`c0re.hyperhiveFlake`/`c0re.nixpkgsFlake` (what a hive there renders into
its meta flake), and the agent to the PR head on the forge. Evaluation is
pure and runs in the container; builds go to the host nix daemon as an
untrusted client. The private config repo is fetched with the token of a
new read-only `builder` forge account (in the `hives` team), which the
controller mints into `swarm/services/builder/forge/token`; git gets it
from a credential helper reading the child's environment, so it is in no
argument or URL.

Credentials: a `builder` store leaf minted by glue-bao-tls on the store
host, a `swarm-builder` reader policy (forge token + its own OIDC client
secret), an authelia machine client, and a `--builder-client` grant in the
queue's auth-callout responder. The controller gains a grant on the token
path and the secret publisher a deny on it.

This is the agent-config build check atlas scoped on #5081 (slice 3):
nothing is pushed to a cache, nothing is written to KV, and a red status
gates no deploy. The check composes agent-base + the config without the
values a hive adds (CA, docs, claude-code path, ports, input follows), so
it can disagree with a hive's own build.

CLAUDE.md

@@ -202,6 +202,13 @@ hand-maintained per-file tree drifts out of sync with the code.
   for agents: nginx sends it `/select/logsql/` requests carrying an agent
   token, it answers 200 or 401 via `swarm-agent-verify`. Runs on the log
   store's host (`swarm-victorialogs.nix`).
+- **`swarm-builder/`** — the swarm builder's build daemon, in its own
+  container where `deploy.builder.enable` is set. Takes an agent config PR's
+  head from `swarm-controller` over the queue, builds it on its host's agent
+  base through the host nix daemon (`nix/builder/check-flake`), and replies
+  with the store path or the error tail; the controller writes the commit
+  status. Holds a read-only forge token. Design:
+  [`docs/swarm/builder.md`](docs/swarm/builder.md).
 - **`swarmctl/`** — swarm-level operator CLI, installed by the
   swarm-controller module on the host that runs the daemon. Runs as
   **root and acts directly** — it serves no socket, publishes no HTTP