swarm-builder: build each agent config PR head and post a commit status

A new `swarm-builder` service, in its own container on the host that sets
`deploy.builder.enable` (defaulted on by `allSwarmServices` where the host
has the builder's store leaf, like the review classifier).

When an `agent-configs/<agent>` PR is opened, reopened or synchronized,
swarm-controller queues a `build_agent` jobq node. The node sets a
`swarm-builder` commit status to pending on the PR head, sends
`{agent, rev, pr}` to the builder over NATS request-reply
(`$SWARM.builder.build`), and writes success (store path), failure (last
line nix printed) or error (no builder / no reply) on the head. The node
fails when the build does, so the Jobs page matches the PR.

The builder builds nix/builder/check-flake's `check` with every input
overridden: hyperhive and nixpkgs to the host's own
`c0re.hyperhiveFlake`/`c0re.nixpkgsFlake` (what a hive there renders into
its meta flake), and the agent to the PR head on the forge. Evaluation is
pure and runs in the container; builds go to the host nix daemon as an
untrusted client. The private config repo is fetched with the token of a
new read-only `builder` forge account (in the `hives` team), which the
controller mints into `swarm/services/builder/forge/token`; git gets it
from a credential helper reading the child's environment, so it is in no
argument or URL.

Credentials: a `builder` store leaf minted by glue-bao-tls on the store
host, a `swarm-builder` reader policy (forge token + its own OIDC client
secret), an authelia machine client, and a `--builder-client` grant in the
queue's auth-callout responder. The controller gains a grant on the token
path and the secret publisher a deny on it.

This is the agent-config build check atlas scoped on #5081 (slice 3):
nothing is pushed to a cache, nothing is written to KV, and a red status
gates no deploy. The check composes agent-base + the config without the
values a hive adds (CA, docs, claude-code path, ports, input follows), so
it can disagree with a hive's own build.

swarm-controller/src/config_pr.rs

@@ -16,8 +16,10 @@
 //!   instead of waiting up to `POLL_INTERVAL`.
 //!
 //! [`merged`] reads the same delivery for a merge, which the webhook handler
-//! turns into a deploy. The poll has no counterpart: it lists open PRs only,
-//! so a merge whose delivery is lost deploys nothing.
+//! turns into a deploy, and [`changed_head`] reads it for a PR's new head,
+//! which the handler turns into a build check (`crate::builder`). The poll
+//! has no counterpart to either: a merge whose delivery is lost deploys
+//! nothing, and a head whose delivery is lost is not built.
 
 use std::collections::HashMap;
 use std::sync::{Arc, Mutex};
@@ -58,12 +60,17 @@ struct WebhookPullRequest {
     /// hive builds its config repo's `main`.
     #[serde(default)]
     base: Option<WebhookBranch>,
+    /// The PR's branch, whose `sha` is the commit a build check builds.
+    #[serde(default)]
+    head: Option<WebhookBranch>,
 }
 
 #[derive(Deserialize)]
 struct WebhookBranch {
     #[serde(rename = "ref")]
     name: String,
+    #[serde(default)]
+    sha: Option<String>,
 }
 
 /// A config PR that was just merged: whose config, and the commit to deploy.
@@ -104,6 +111,43 @@ pub fn merged(body: &[u8]) -> Option<MergedConfigPr> {
     })
 }
 
+/// A config PR whose head just changed: whose config, the head commit, and
+/// the PR.
+#[derive(Debug, PartialEq, Eq)]
+pub struct ChangedConfigPr {
+    pub agent: String,
+    pub rev: String,
+    pub pr: u64,
+}
+
+/// The new head a verified `ConfigPr` delivery reports, if it reports one: a
+/// PR opened, reopened, or pushed to (`synchronized`). Edits and labels leave
+/// the head as it was and build nothing. A body that does not parse is
+/// `None`; [`ConfigPrCache::apply_webhook_delivery`] already logs it.
+pub fn changed_head(body: &[u8]) -> Option<ChangedConfigPr> {
+    let payload: ConfigPrWebhookPayload = serde_json::from_slice(body).ok()?;
+    if !matches!(
+        payload.action.as_str(),
+        "opened" | "reopened" | "synchronized"
+    ) || payload.pull_request.state != "open"
+    {
+        return None;
+    }
+    let Some(rev) = payload.pull_request.head.and_then(|h| h.sha) else {
+        tracing::warn!(
+            agent = %payload.repository.name,
+            pr = payload.pull_request.number,
+            "config-pr webhook: PR carries no head sha; nothing built"
+        );
+        return None;
+    };
+    Some(ChangedConfigPr {
+        agent: payload.repository.name,
+        rev,
+        pr: payload.pull_request.number,
+    })
+}
+
 #[derive(Deserialize)]
 struct WebhookRepository {
     /// The config repo's name IS the agent's name — same convention
@@ -369,4 +413,42 @@ mod tests {
             .expect("prior entry must survive a bad delivery");
         assert_eq!(status.pr_number, 5);
     }
+
+    fn head_changed(action: &str) -> Vec<u8> {
+        serde_json::json!({
+            "action": action,
+            "pull_request": {
+                "number": 5,
+                "state": "open",
+                "head": { "ref": "fix", "sha": "def456" },
+                "base": { "ref": "main", "sha": "abc123" },
+            },
+            "repository": { "name": "damocles" },
+        })
+        .to_string()
+        .into_bytes()
+    }
+
+    #[test]
+    fn an_opened_reopened_or_pushed_pr_names_its_head() {
+        for action in ["opened", "reopened", "synchronized"] {
+            assert_eq!(
+                super::changed_head(&head_changed(action)),
+                Some(super::ChangedConfigPr {
+                    agent: "damocles".to_owned(),
+                    rev: "def456".to_owned(),
+                    pr: 5,
+                }),
+                "{action}"
+            );
+        }
+    }
+
+    #[test]
+    fn an_edit_a_label_or_a_close_builds_nothing() {
+        for action in ["edited", "label_updated", "closed"] {
+            assert_eq!(super::changed_head(&head_changed(action)), None, "{action}");
+        }
+        assert_eq!(super::changed_head(&closed(true)), None);
+    }
 }