swarm-builder: build each agent config PR head and post a commit status

A new `swarm-builder` service, in its own container on the host that sets
`deploy.builder.enable` (defaulted on by `allSwarmServices` where the host
has the builder's store leaf, like the review classifier).

When an `agent-configs/<agent>` PR is opened, reopened or synchronized,
swarm-controller queues a `build_agent` jobq node. The node sets a
`swarm-builder` commit status to pending on the PR head, sends
`{agent, rev, pr}` to the builder over NATS request-reply
(`$SWARM.builder.build`), and writes success (store path), failure (last
line nix printed) or error (no builder / no reply) on the head. The node
fails when the build does, so the Jobs page matches the PR.

The builder builds nix/builder/check-flake's `check` with every input
overridden: hyperhive and nixpkgs to the host's own
`c0re.hyperhiveFlake`/`c0re.nixpkgsFlake` (what a hive there renders into
its meta flake), and the agent to the PR head on the forge. Evaluation is
pure and runs in the container; builds go to the host nix daemon as an
untrusted client. The private config repo is fetched with the token of a
new read-only `builder` forge account (in the `hives` team), which the
controller mints into `swarm/services/builder/forge/token`; git gets it
from a credential helper reading the child's environment, so it is in no
argument or URL.

Credentials: a `builder` store leaf minted by glue-bao-tls on the store
host, a `swarm-builder` reader policy (forge token + its own OIDC client
secret), an authelia machine client, and a `--builder-client` grant in the
queue's auth-callout responder. The controller gains a grant on the token
path and the secret publisher a deny on it.

This is the agent-config build check atlas scoped on #5081 (slice 3):
nothing is pushed to a cache, nothing is written to KV, and a red status
gates no deploy. The check composes agent-base + the config without the
values a hive adds (CA, docs, claude-code path, ports, input follows), so
it can disagree with a hive's own build.

swarm-queue-client/src/builder.rs

@@ -0,0 +1,75 @@
+//! The swarm builder's builds: the subject swarm-controller sends a build on,
+//! and what travels each way.
+//!
+//! Three crates name these: the controller sends the request, the builder
+//! answers it, and the auth-callout responder grants the one subject to each.
+
+use std::time::Duration;
+
+use serde::{Deserialize, Serialize};
+
+/// The subject every build goes to. The controller is its one publisher and
+/// the builder its one subscriber; the builder answers on the request's reply
+/// subject.
+pub const SUBJECT: &str = "$SWARM.builder.build";
+
+/// The queue group the builder subscribes in, so a second instance shares the
+/// requests instead of running each one twice.
+pub const QUEUE_GROUP: &str = "builder";
+
+/// The longest one build may take before the builder stops it and answers
+/// with a timeout.
+pub const BUILD_DEADLINE: Duration = Duration::from_hours(1);
+
+/// How long the controller waits for the reply, and the queue lets the
+/// builder answer: the build at its deadline, plus a minute for the rest.
+pub const REPLY_DEADLINE: Duration = Duration::from_mins(61);
+
+/// One build: an agent's config repo at one commit, on the builder's own
+/// agent base.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct BuildAgent {
+    /// The agent, which is also its config repo's name.
+    pub agent: String,
+    /// The commit to build.
+    pub rev: String,
+    /// The PR the commit is the head of; its `refs/pull/<pr>/head` is the ref
+    /// the builder fetches the commit through.
+    pub pr: u64,
+}
+
+/// The builder's answer to one [`BuildAgent`].
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(tag = "state", rename_all = "kebab-case")]
+pub enum Reply {
+    /// The config built; `out_path` is the system closure's store path.
+    Built { out_path: String },
+    /// The build did not finish: the last lines `nix` printed, or why the
+    /// builder could not start it.
+    Failed { error_tail: String },
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_wire_tags_the_reply_by_state() {
+        let json = serde_json::to_value(Reply::Built {
+            out_path: "/nix/store/x".to_owned(),
+        })
+        .expect("encodes");
+        assert_eq!(json["state"], "built");
+        assert_eq!(json["out_path"], "/nix/store/x");
+        let json = serde_json::to_value(Reply::Failed {
+            error_tail: "e".to_owned(),
+        })
+        .expect("encodes");
+        assert_eq!(json["state"], "failed");
+    }
+
+    #[test]
+    fn the_reply_deadline_outlasts_the_build() {
+        assert!(REPLY_DEADLINE > BUILD_DEADLINE);
+    }
+}

swarm-queue-client/src/lib.rs

@@ -404,6 +404,9 @@ pub mod review_classifier;
 
 pub mod stored_secret;
 
+/// The builder's build subject and the request and reply it carries.
+pub mod builder;
+
 /// Only the fields this needs; authelia returns several.
 #[derive(serde::Deserialize)]
 struct TokenResponse {