swarm-builder: build each agent config PR head and post a commit status

A new `swarm-builder` service, in its own container on the host that sets
`deploy.builder.enable` (defaulted on by `allSwarmServices` where the host
has the builder's store leaf, like the review classifier).

When an `agent-configs/<agent>` PR is opened, reopened or synchronized,
swarm-controller queues a `build_agent` jobq node. The node sets a
`swarm-builder` commit status to pending on the PR head, sends
`{agent, rev, pr}` to the builder over NATS request-reply
(`$SWARM.builder.build`), and writes success (store path), failure (last
line nix printed) or error (no builder / no reply) on the head. The node
fails when the build does, so the Jobs page matches the PR.

The builder builds nix/builder/check-flake's `check` with every input
overridden: hyperhive and nixpkgs to the host's own
`c0re.hyperhiveFlake`/`c0re.nixpkgsFlake` (what a hive there renders into
its meta flake), and the agent to the PR head on the forge. Evaluation is
pure and runs in the container; builds go to the host nix daemon as an
untrusted client. The private config repo is fetched with the token of a
new read-only `builder` forge account (in the `hives` team), which the
controller mints into `swarm/services/builder/forge/token`; git gets it
from a credential helper reading the child's environment, so it is in no
argument or URL.

Credentials: a `builder` store leaf minted by glue-bao-tls on the store
host, a `swarm-builder` reader policy (forge token + its own OIDC client
secret), an authelia machine client, and a `--builder-client` grant in the
queue's auth-callout responder. The controller gains a grant on the token
path and the secret publisher a deny on it.

This is the agent-config build check atlas scoped on #5081 (slice 3):
nothing is pushed to a cache, nothing is written to KV, and a red status
gates no deploy. The check composes agent-base + the config without the
values a hive adds (CA, docs, claude-code path, ports, input follows), so
it can disagree with a hive's own build.

nix/host-modules/swarm-bao.nix

@@ -441,6 +441,10 @@ let
       capabilities = ["create", "read", "update"]
     }
 
+    path "${credentialMountPath}/data/${builderForgeTokenLeaf}" {
+      capabilities = ["create", "read", "update"]
+    }
+
     path "${credentialMountPath}/data/${swarmAppserviceTokenLeaf}" {
       capabilities = ["read"]
     }
@@ -492,6 +496,8 @@ let
   # The review classifier's forge token is denied too: the controller posts
   # the classifier's reviews with whatever token is there, so a write to it
   # picks the account those reviews come from.
+  # So is the builder's: a write to it picks the account the builder fetches
+  # config repos as.
   secretPublisherPolicyText = ''
     path "${credentialMountPath}/data/swarm/hives/*" {
       capabilities = ["create", "update"]
@@ -521,6 +527,10 @@ let
       capabilities = ["deny"]
     }
 
+    path "${credentialMountPath}/data/${builderForgeTokenLeaf}" {
+      capabilities = ["deny"]
+    }
+
     path "${credentialMountPath}/data/${controllerClientLeaf}" {
       capabilities = ["create", "update"]
     }
@@ -588,6 +598,12 @@ let
   # the UI's OIDC login; the classifier reads it on every run.
   classifierApiKeyLeaf = "swarm/services/review-classifier/anthropic-api-key";
 
+  # The swarm builder's forge token, the nix half of
+  # `swarm_secret_client::builder::forge_token_path`. The controller mints it
+  # and reads it back before deciding whether to re-mint; the builder reads it
+  # to fetch config repos.
+  builderForgeTokenLeaf = "swarm/services/builder/forge/token";
+
   # The UI's OIDC client secret. The publisher writes it; the granter reads it
   # into the `oidc` auth method's config, which is the only copy bao uses.
   baoUiClientLeaf = "swarm/services/${cfg.ui.oidc.clientId}/oidc/client";
@@ -998,6 +1014,18 @@ let
     }
   ];
 
+  # The swarm builder: its forge token, read once per build, and its own queue
+  # client secret, read at start. Both by the daemon inside its container.
+  builderReaders = [
+    {
+      name = "swarm-builder";
+      cn = baoDeploy.builderCommonName;
+      policyText =
+        readStanza "${credentialMountPath}/data/${builderForgeTokenLeaf}"
+        + readStanza "${credentialMountPath}/data/swarm/services/${hyperhiveCfg.swarm.builder.clientId}/oidc/client";
+    }
+  ];
+
   # The forge host's one store identity. `swarm-bao-forge-publisher` writes
   # the controller's forge token under it, the one writer of that path and
   # write-only: it copies a file in and never reads one back.
@@ -1848,6 +1876,19 @@ in
       '';
     };
 
+    builderCommonName = lib.mkOption {
+      type = lib.types.str;
+      default = "swarm-builder";
+      description = ''
+        Subject the store's `swarm-builder` cert-auth role accepts: the
+        identity the swarm builder presents from inside its container. Its
+        grant is two paths, read only: `swarm/services/builder/forge/token`
+        and its own queue client secret.
+
+        ⚠️ Reserved as a hive name by ./swarm.nix, like its siblings.
+      '';
+    };
+
     forgePublisherCommonName = lib.mkOption {
       type = lib.types.str;
       default = "swarm-forge-publisher";
@@ -2123,6 +2164,31 @@ in
       '';
     };
 
+    builderClientCertFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/var/lib/swarm-bao-pki/builder.pem";
+      description = ''
+        Certificate the swarm builder presents to the store. Its subject must
+        be {option}`services.hyperhive.deploy.bao.builderCommonName`.
+
+        ./glue-bao-tls.nix points it at the leaf it mints on the store's host.
+        On a builder host without the store, it is a file the operator copies
+        from the store's host. A path, never a value.
+      '';
+    };
+
+    builderClientKeyFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      example = "/var/lib/swarm-bao-pki/builder-key.pem";
+      description = ''
+        Private key for
+        {option}`services.hyperhive.deploy.bao.builderClientCertFile`.
+        A path, never a value.
+      '';
+    };
+
     forgePublisherClientCertFile = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
       default = null;
@@ -3201,6 +3267,8 @@ in
 
       systemd.services.swarm-bao-review-classifier-policy = readerPolicyUnit "write the review classifier's API-key-reader bao policy and cert-auth role" reviewClassifierReaders;
 
+      systemd.services.swarm-bao-builder-policy = readerPolicyUnit "write the swarm builder's forge-token-reader bao policy and cert-auth role" builderReaders;
+
       systemd.services.swarm-bao-forge-publisher-policy = readerPolicyUnit "write the forge's controller-token-publisher bao policy and cert-auth role" forgePublisherWriters;
 
       # A FOURTH sibling, same shape and same reasons as the two above. This