swarm: tests and docs for the queue-credential revocation

Pins the three properties the revocation rests on and cannot check
against a store: that only `Destroyed` revokes (a revocation on
`Offline` or `Paused` would give an agent that stops and never
restarts), that a 404 is absence while a 403 stays a failure, and that
the delete addresses `secret/metadata/` -- the path that takes every
version, which is the string the grant has to match.

docs/swarm/credentials.md gains the revocation section and its table
cell stops describing the deletion as something an operator does by
hand.

swarm-controller/src/agent_identity.rs

@@ -364,6 +364,39 @@ mod tests {
         assert!(!a.contains('='), "{a}");
     }
 
+    /// Revocation undoes step 3 of the mint and nothing else, and both ends
+    /// spell the path through one function — the property that keeps a
+    /// revocation from missing the object it is meant to remove.
+    ///
+    /// The second half is what stops this being a tautology: the agent's
+    /// other published object, the mTLS leaf, is at a different path and is
+    /// deliberately left alone. Revoking both would take away the identity a
+    /// re-created agent is re-minted under, for a credential problem that is
+    /// only about the queue.
+    #[test]
+    fn revocation_names_the_path_the_mint_published_and_not_the_leaf_beside_it() {
+        use swarm_secret_client::{mtls, queue};
+
+        assert_eq!(
+            queue::agent_queue_path("atlas").expect("a plain name is legal"),
+            "swarm/agents/atlas/queue"
+        );
+        assert_ne!(
+            queue::agent_queue_path("atlas").expect("legal"),
+            mtls::identity_path("atlas").expect("legal"),
+        );
+    }
+
+    /// A name the store must never be asked to delete under. `revoke_queue_credential`
+    /// builds its path with the same validating function the mint does, so a
+    /// traversal is refused before a request is made rather than addressing
+    /// some other principal's secret.
+    #[test]
+    fn a_traversal_never_becomes_a_revocation() {
+        swarm_secret_client::queue::agent_queue_path("../pr1ma")
+            .expect_err("a traversal is not a legal agent name");
+    }
+
     fn both(k: &str) -> Option<String> {
         match k {
             ENV_AGENT_PKI_MOUNT => Some("pki-agents".to_owned()),