swarm-builder: scope the forge token to the forge, one build at a time, opt-in

argus's review on #5177: the git credential helper answered every `get`,
so a config PR's own flake inputs could have git send the builder's forge
token to any host. The helper is now configured under
`credential.<forge-url>.helper` and itself answers only an https request
whose host is the forge's; a test runs it as git does and checks that
other hosts, http and non-get operations get nothing.

Builds are bounded: every `build_agent` node needs the one `builder` jobq
resource, so one runs at a time and the rest wait pending, and a newer
head cancels its PR's pending build (a running one finishes and writes on
its own commit). The builder also holds a one-permit semaphore around each
build.

`builder` and `review-classifier`, the forge logins swarm-controller owns,
join nix/reserved-names.nix, with a test tying the list to both constants.

The builder is now opt-in like the CI runner: `allSwarmServices` no longer
turns it on, since it runs unreviewed config PRs through the host's nix
daemon. mara had not answered atlas's question on the PR.

nix/host-modules/swarm-builder.nix

@@ -1,8 +1,9 @@
 # The swarm builder, in a `swarm-builder` container on the host that sets
-# `deploy.builder.enable`, which `deploy.allSwarmServices` defaults on where
-# the host has the builder's store identity. It builds agent configs for
-# swarm-controller: the controller sends a config PR's head over the queue,
-# and the daemon builds that config on this host's agent base and replies.
+# `deploy.builder.enable`, which nothing turns on for the operator: it runs
+# unreviewed config PRs through the host's nix daemon. It builds agent configs
+# for swarm-controller: the controller sends a config PR's head over the
+# queue, and the daemon builds that config on this host's agent base and
+# replies.
 # docs/swarm/builder.md has the design.
 #
 # ⚠️ Its own network namespace on the bridge, as ./swarm-ci-runner.nix has: a