swarm-builder: scope the forge token to the forge, one build at a time, opt-in

argus's review on #5177: the git credential helper answered every `get`,
so a config PR's own flake inputs could have git send the builder's forge
token to any host. The helper is now configured under
`credential.<forge-url>.helper` and itself answers only an https request
whose host is the forge's; a test runs it as git does and checks that
other hosts, http and non-get operations get nothing.

Builds are bounded: every `build_agent` node needs the one `builder` jobq
resource, so one runs at a time and the rest wait pending, and a newer
head cancels its PR's pending build (a running one finishes and writes on
its own commit). The builder also holds a one-permit semaphore around each
build.

`builder` and `review-classifier`, the forge logins swarm-controller owns,
join nix/reserved-names.nix, with a test tying the list to both constants.

The builder is now opt-in like the CI runner: `allSwarmServices` no longer
turns it on, since it runs unreviewed config PRs through the host's nix
daemon. mara had not answered atlas's question on the PR.

nix/reserved-names.nix

@@ -22,9 +22,9 @@
 # here forbids it for both. That is the point: two lists is how they drift.
 #
 # ⚠️ Every entry must be a value some component actually PRODUCES as a message
-# `from`/`to`, a component name the collector builds pipelines from, or a
-# username the forge refuses — not a word that merely looked risky. A name in
-# here that nothing emits or refuses is a refusal with no failure behind it.
+# `from`/`to`, a component name the collector builds pipelines from, or a forge
+# username the forge refuses or a swarm service owns — not a word that merely
+# looked risky. A name nothing emits or refuses is a refusal with no failure.
 #
 # ⚠️ Matched by EQUALITY. Words forbidden *inside* a hive name live in
 # `./reserved-hive-fragments.nix` — read its header before merging the two.
@@ -90,6 +90,13 @@
   "repo-avatars"
   "user"
   "v2"
+
+  # ---- forge accounts swarm-controller owns ----------------------------
+  # Service accounts it creates under these logins (`forge::builder_account`,
+  # `forge::classifier_account`). An agent of the same name would be refused
+  # one node into provisioning, and would keep the service from its token.
+  "builder"
+  "review-classifier"
 ]
 # Deliberately absent, and it is a load-bearing omission:
 #