swarm-builder: scope the forge token to the forge, one build at a time, opt-in

argus's review on #5177: the git credential helper answered every `get`,
so a config PR's own flake inputs could have git send the builder's forge
token to any host. The helper is now configured under
`credential.<forge-url>.helper` and itself answers only an https request
whose host is the forge's; a test runs it as git does and checks that
other hosts, http and non-get operations get nothing.

Builds are bounded: every `build_agent` node needs the one `builder` jobq
resource, so one runs at a time and the rest wait pending, and a newer
head cancels its PR's pending build (a running one finishes and writes on
its own commit). The builder also holds a one-permit semaphore around each
build.

`builder` and `review-classifier`, the forge logins swarm-controller owns,
join nix/reserved-names.nix, with a test tying the list to both constants.

The builder is now opt-in like the CI runner: `allSwarmServices` no longer
turns it on, since it runs unreviewed config PRs through the host's nix
daemon. mara had not answered atlas's question on the PR.

nix/host-modules/swarm-required-services.nix

@@ -117,11 +117,4 @@ in
     && deployCfg.bao.reviewClassifierClientCertFile != null
     && deployCfg.bao.reviewClassifierClientKeyFile != null
   );
-
-  # The swarm builder, defaulted on the same terms as the review classifier.
-  config.services.hyperhive.deploy.builder.enable = lib.mkDefault (
-    deployCfg.allSwarmServices
-    && deployCfg.bao.builderClientCertFile != null
-    && deployCfg.bao.builderClientKeyFile != null
-  );
 }