swarm-bao-tls: drop the unreachable CN fallback

`clientCn` fell back to `cfg.domain` when `hiveName` was unset. That branch
cannot run: `hive-network.nix` asserts `hiveName != null` under
`mkIf services.hyperhive.enable`, and this file's `config` is gated on the same
predicate, so any host that evaluates the conditional has already failed the
assertion.

Worse than dead, it read as a second supported spelling of a hive's identity —
which is what a cert-auth role matches on. It was not even the hive's own
domain: `cfg` here is `services.hyperhive.swarm.bao`, so the fallback resolved
to the store's address, one string shared by every hive in the swarm and the
same CN the server leaf carries.

Reading the option directly matches what other modules needing the name already
do (`hive-c0re/environment.nix`).

nix/host-modules/glue-bao-tls.nix

@@ -43,7 +43,10 @@ let
 
   # What a reader calls itself to the store. The hive's name, because a bao
   # cert-auth role matches on the CN — this is an interface, not a label.
-  clientCn = if hyperhiveCfg.hiveName != null then hyperhiveCfg.hiveName else cfg.domain;
+  # No fallback: `hiveName` is asserted set for every hyperhive host, which is
+  # the same condition this file's `config` is gated on. A fallback here reads
+  # as a second supported spelling and there is no such thing.
+  clientCn = hyperhiveCfg.hiveName;
 
   # $1 dir  $2 basename  $3 CN  $4 SAN or ""  $5 EKU
   signLeaf = pkgs.writeShellScript "swarm-bao-sign-leaf" ''