swarm-builder: build each agent config PR head and post a commit status

A new `swarm-builder` service, in its own container on the host that sets
`deploy.builder.enable` (defaulted on by `allSwarmServices` where the host
has the builder's store leaf, like the review classifier).

When an `agent-configs/<agent>` PR is opened, reopened or synchronized,
swarm-controller queues a `build_agent` jobq node. The node sets a
`swarm-builder` commit status to pending on the PR head, sends
`{agent, rev, pr}` to the builder over NATS request-reply
(`$SWARM.builder.build`), and writes success (store path), failure (last
line nix printed) or error (no builder / no reply) on the head. The node
fails when the build does, so the Jobs page matches the PR.

The builder builds nix/builder/check-flake's `check` with every input
overridden: hyperhive and nixpkgs to the host's own
`c0re.hyperhiveFlake`/`c0re.nixpkgsFlake` (what a hive there renders into
its meta flake), and the agent to the PR head on the forge. Evaluation is
pure and runs in the container; builds go to the host nix daemon as an
untrusted client. The private config repo is fetched with the token of a
new read-only `builder` forge account (in the `hives` team), which the
controller mints into `swarm/services/builder/forge/token`; git gets it
from a credential helper reading the child's environment, so it is in no
argument or URL.

Credentials: a `builder` store leaf minted by glue-bao-tls on the store
host, a `swarm-builder` reader policy (forge token + its own OIDC client
secret), an authelia machine client, and a `--builder-client` grant in the
queue's auth-callout responder. The controller gains a grant on the token
path and the secret publisher a deny on it.

This is the agent-config build check atlas scoped on #5081 (slice 3):
nothing is pushed to a cache, nothing is written to KV, and a red status
gates no deploy. The check composes agent-base + the config without the
values a hive adds (CA, docs, claude-code path, ports, input follows), so
it can disagree with a hive's own build.

swarm-controller/src/forge.rs

@@ -21,12 +21,12 @@
 use anyhow::{Context, Result};
 use forgejo_api::structs::{
     AddCollaboratorOption, AddCollaboratorOptionPermission, ChangeFileOperation,
-    ChangeFileOperationOperation, ChangeFilesOptions, CreateBranchProtectionOption,
-    CreateHookOption, CreateHookOptionConfig, CreateHookOptionType, CreateRepoOption,
-    CreateUserOption, EditUserOption, GetTreeQuery, GitEntry, IssueListIssuesQuery,
-    IssueListIssuesQueryState, IssueListIssuesQueryType, RepoDownloadPullDiffOrPatchQuery,
-    RepoGetContentsQuery, RepoGetPullRequestCommitsQuery, RepoListPullRequestsQuery,
-    RepoListPullRequestsQueryState, RepoSearchQuery, StateType,
+    ChangeFileOperationOperation, ChangeFilesOptions, CommitStatusState,
+    CreateBranchProtectionOption, CreateHookOption, CreateHookOptionConfig, CreateHookOptionType,
+    CreateRepoOption, CreateStatusOption, CreateUserOption, EditUserOption, GetTreeQuery, GitEntry,
+    IssueListIssuesQuery, IssueListIssuesQueryState, IssueListIssuesQueryType,
+    RepoDownloadPullDiffOrPatchQuery, RepoGetContentsQuery, RepoGetPullRequestCommitsQuery,
+    RepoListPullRequestsQuery, RepoListPullRequestsQueryState, RepoSearchQuery, StateType,
 };
 use forgejo_api::{ApiErrorKind, Auth, Forgejo, ForgejoError};
 use futures_util::{StreamExt as _, TryStreamExt as _};
@@ -40,6 +40,7 @@ use crate::webhook::DeliveryKind;
 use swarm_queue_client::review_classifier::Commit;
 
 pub mod agent_token;
+pub mod builder_account;
 pub mod classifier_account;
 pub mod docs_grant;
 pub mod hive_token;
@@ -48,6 +49,24 @@ pub mod objects;
 pub mod runner_token;
 pub mod site_admin;
 
+/// The longest commit status description [`Client::create_commit_status`]
+/// sends, in characters. The forge keeps more; its PR view shows one line.
+pub const STATUS_DESCRIPTION_MAX: usize = 200;
+
+/// `description` cut to [`STATUS_DESCRIPTION_MAX`] characters, an ellipsis
+/// marking a cut.
+fn status_description(description: &str) -> String {
+    if description.chars().count() <= STATUS_DESCRIPTION_MAX {
+        return description.to_owned();
+    }
+    let mut cut: String = description
+        .chars()
+        .take(STATUS_DESCRIPTION_MAX - 1)
+        .collect();
+    cut.push('…');
+    cut
+}
+
 /// An agent's open config-PR, as [`Client::list_open_config_prs`] reports it
 /// and `GET /api/agents/{name}/config-pr` serves it.
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize, ToSchema)]
@@ -163,7 +182,7 @@ const OPERATORS_TEAM: &str = "operators";
 /// The merge gate survives the distinction: [`objects`] provisions the
 /// `operators` team in **both** orgs precisely so branch protection can be
 /// applied in either.
-const CONFIG_ORG: &str = "agent-configs";
+pub(crate) const CONFIG_ORG: &str = "agent-configs";
 
 /// The hive-wide knowledge repo, where the `push` hook lives. Same values as
 /// `hive-c0re::workers::knowledge::{ORG, REPO}`.
@@ -1127,6 +1146,38 @@ impl Client {
         Ok(rows.into_iter().flatten().collect())
     }
 
+    /// Set the commit status named `context` on `sha` of `owner/repo` to
+    /// `state`, with `description` cut to [`STATUS_DESCRIPTION_MAX`]
+    /// characters.
+    ///
+    /// # Errors
+    /// The forge refused the status.
+    pub async fn create_commit_status(
+        &self,
+        owner: &str,
+        repo: &str,
+        sha: &str,
+        context: &str,
+        state: CommitStatusState,
+        description: &str,
+    ) -> Result<()> {
+        self.api
+            .repo_create_status(
+                owner,
+                repo,
+                sha,
+                CreateStatusOption {
+                    context: Some(context.to_owned()),
+                    description: Some(status_description(description)),
+                    state: Some(state),
+                    target_url: None,
+                },
+            )
+            .await
+            .with_context(|| format!("set the {context} status on {sha} of {owner}/{repo}"))?;
+        Ok(())
+    }
+
     /// What the review classifier reads of `owner/repo`'s PR `number`: its
     /// head commit, its commits oldest first with their full messages, and
     /// its unified diff.
@@ -2368,4 +2419,41 @@ mod tests {
             .unwrap_err();
         assert!(!no_repo(&tree), "{tree:#}");
     }
+
+    #[test]
+    fn a_long_status_description_is_cut_with_an_ellipsis() {
+        assert_eq!(status_description("built"), "built");
+        let long = "é".repeat(STATUS_DESCRIPTION_MAX + 5);
+        let cut = status_description(&long);
+        assert_eq!(cut.chars().count(), STATUS_DESCRIPTION_MAX);
+        assert!(cut.ends_with('…'));
+    }
+
+    #[tokio::test]
+    async fn a_commit_status_is_posted_on_the_commit() {
+        let (client, seen) = stub_forge(
+            (201, r#"{"id":1}"#),
+            (404, r#"{"message":"not stubbed"}"#),
+            (404, r#"{"message":"not stubbed"}"#),
+        )
+        .await;
+        client
+            .create_commit_status(
+                CONFIG_ORG,
+                "atlas",
+                "abc",
+                "swarm-builder",
+                CommitStatusState::Failure,
+                "error: boom",
+            )
+            .await
+            .expect("the stub accepts the status");
+        let seen = seen.lock().unwrap();
+        let (method, path, body) = seen.first().expect("one request");
+        assert_eq!(method, "POST");
+        assert_eq!(path, "/api/v1/repos/agent-configs/atlas/statuses/abc");
+        assert_eq!(body["context"], "swarm-builder");
+        assert_eq!(body["state"], "failure");
+        assert_eq!(body["description"], "error: boom");
+    }
 }