swarm-builder: scope the forge token to the forge, one build at a time, opt-in

argus's review on #5177: the git credential helper answered every `get`,
so a config PR's own flake inputs could have git send the builder's forge
token to any host. The helper is now configured under
`credential.<forge-url>.helper` and itself answers only an https request
whose host is the forge's; a test runs it as git does and checks that
other hosts, http and non-get operations get nothing.

Builds are bounded: every `build_agent` node needs the one `builder` jobq
resource, so one runs at a time and the rest wait pending, and a newer
head cancels its PR's pending build (a running one finishes and writes on
its own commit). The builder also holds a one-permit semaphore around each
build.

`builder` and `review-classifier`, the forge logins swarm-controller owns,
join nix/reserved-names.nix, with a test tying the list to both constants.

The builder is now opt-in like the CI runner: `allSwarmServices` no longer
turns it on, since it runs unreviewed config PRs through the host's nix
daemon. mara had not answered atlas's question on the PR.

nix/host-modules/deploy.nix

@@ -689,11 +689,13 @@ in
         this host's nix daemon, and swarm-controller writes the result as a
         `swarm-builder` commit status on the PR.
 
-        On by default where
-        {option}`services.hyperhive.deploy.allSwarmServices` is set and this
-        host has the builder's store identity (the pair
-        {option}`services.hyperhive.deploy.bao.builderClientCertFile` and
-        `builderClientKeyFile`, minted on the store's host).
+        Not derived from
+        {option}`services.hyperhive.deploy.allSwarmServices`: the builder
+        evaluates and builds unreviewed config PRs on this host's nix daemon,
+        so running one is a decision of its own, as for the CI runner. It needs
+        the builder's store identity
+        ({option}`services.hyperhive.deploy.bao.builderClientCertFile` and
+        `builderClientKeyFile`), which the store's host mints.
       '';
     };
 

nix/host-modules/swarm-builder.nix

@@ -1,8 +1,9 @@
 # The swarm builder, in a `swarm-builder` container on the host that sets
-# `deploy.builder.enable`, which `deploy.allSwarmServices` defaults on where
-# the host has the builder's store identity. It builds agent configs for
-# swarm-controller: the controller sends a config PR's head over the queue,
-# and the daemon builds that config on this host's agent base and replies.
+# `deploy.builder.enable`, which nothing turns on for the operator: it runs
+# unreviewed config PRs through the host's nix daemon. It builds agent configs
+# for swarm-controller: the controller sends a config PR's head over the
+# queue, and the daemon builds that config on this host's agent base and
+# replies.
 # docs/swarm/builder.md has the design.
 #
 # ⚠️ Its own network namespace on the bridge, as ./swarm-ci-runner.nix has: a

nix/host-modules/swarm-required-services.nix

@@ -117,11 +117,4 @@ in
     && deployCfg.bao.reviewClassifierClientCertFile != null
     && deployCfg.bao.reviewClassifierClientKeyFile != null
   );
-
-  # The swarm builder, defaulted on the same terms as the review classifier.
-  config.services.hyperhive.deploy.builder.enable = lib.mkDefault (
-    deployCfg.allSwarmServices
-    && deployCfg.bao.builderClientCertFile != null
-    && deployCfg.bao.builderClientKeyFile != null
-  );
 }