keep the cache's key and pull token for hive-priv in a root-only directory

nix/host-modules/swarm-bao.nix

@@ -935,8 +935,30 @@ let
     cn = "${baoDeploy.hiveLeafCommonNamePrefix}-${hiveName}";
     inherit (hive) domain;
     dashboard = hyperhiveCfg.swarm.dashboardDomains.${hiveName};
+    inherit hiveName;
   }) hyperhiveCfg.swarm.hives;
 
+  # What a hive's gateway-leaf identity may do: issue from its own role, and
+  # read two of its own cache facts. The root unit on the hive host
+  # (`hive-priv-cache-facts`, ./hive-priv-cache.nix) reads them under this
+  # identity: the key hive-priv's downloads must be signed by, and the token it
+  # pulls with. The cache's URL and name come from the host's configuration,
+  # not from the store.
+  hiveLeafPolicyText =
+    obj:
+    ''
+      path "${servicesPkiMountPath}/issue/${obj.name}" {
+        capabilities = ["update"]
+      }
+    ''
+    +
+      lib.concatMapStrings
+        (fact: readStanza "${credentialMountPath}/data/swarm/hives/${obj.hiveName}/attic/${fact}")
+        [
+          "public-key"
+          "pull-token"
+        ];
+
   # The PKI mount agent client certificates are issued from. Its root is
   # generated inside the store, so the agent CA's key never exists outside it.
   # A mount of its own because the services mount holds exactly one issuer; a
@@ -2241,9 +2263,11 @@ in
       example = "swarm-bao-hive-leaf.svc";
       description = ''
         Prefix of the subject the store's per-hive gateway-leaf roles accept.
-        The role for hive `h` accepts `<prefix>-h` and may only issue from
+        The role for hive `h` accepts `<prefix>-h`. Its policy may issue from
         `<servicesPkiMountPath>/issue/<hiveLeafPkiRolePrefix>-h`, which issues
-        for `h`'s domain and `*.` that domain and nothing else.
+        for `h`'s domain and `*.` that domain and nothing else, and read
+        `secret/swarm/hives/h/attic/public-key` and `…/pull-token`, which the
+        root unit `hive-priv-cache-facts` fetches for hive-priv.
 
         Per hive because one subject for every hive could ask for any hive's
         certificate.
@@ -3792,11 +3816,7 @@ in
                 ttl=${servicesPkiLeafTtl} \
                 max_ttl=${servicesPkiLeafTtl}
 
-              printf '%s' ${lib.escapeShellArg ''
-                path "${servicesPkiMountPath}/issue/${obj.name}" {
-                  capabilities = ["update"]
-                }
-              ''} |
+              printf '%s' ${lib.escapeShellArg (hiveLeafPolicyText obj)} |
                 bao policy write ${lib.escapeShellArg obj.name} -
 
               bao write auth/cert/certs/${lib.escapeShellArg obj.name} \