swarm-builder: scope the forge token to the forge, one build at a time, opt-in

argus's review on #5177: the git credential helper answered every `get`,
so a config PR's own flake inputs could have git send the builder's forge
token to any host. The helper is now configured under
`credential.<forge-url>.helper` and itself answers only an https request
whose host is the forge's; a test runs it as git does and checks that
other hosts, http and non-get operations get nothing.

Builds are bounded: every `build_agent` node needs the one `builder` jobq
resource, so one runs at a time and the rest wait pending, and a newer
head cancels its PR's pending build (a running one finishes and writes on
its own commit). The builder also holds a one-permit semaphore around each
build.

`builder` and `review-classifier`, the forge logins swarm-controller owns,
join nix/reserved-names.nix, with a test tying the list to both constants.

The builder is now opt-in like the CI runner: `allSwarmServices` no longer
turns it on, since it runs unreviewed config PRs through the host's nix
daemon. mara had not answered atlas's question on the PR.

nix/module-eval/swarm-services-switch.nix

@@ -472,7 +472,7 @@ let
       # that lost a container can't pass by comparing fewer of them.
       name = "every service container restates its host-side privateNetwork";
       ok =
-        lib.length (lib.attrNames serviceContainers) == 12
+        lib.length (lib.attrNames serviceContainers) == 11
         && lib.all (
           c: c.privateNetwork == (c.config.services.hyperhive.swarmContainer.privateNetwork or null)
         ) (lib.attrValues serviceContainers);