swarm-bao: let the controller write agent credentials, and gate that it can

Closes #4124.

The controller's policy granted only the bootstrap paths -- hive cert-auth
roles and hive ACLs. #4113 then made it a secret WRITER, and nothing related
the grants to the paths the code writes, so every matrix token provision
answered 403. The two halves landed on different issues and neither looked
wrong on its own.

`secret/data/` is KV v2's ACL prefix and is absent from the path the code
passes, so matching `swarm-secret-client`'s spelling literally would have
granted nothing. Write-only: the controller mints these and never reads one
back, and a read capability would let it recover every agent's credentials
rather than only replace them.

The gate is the point. Two module-eval arms -- the grant exists and is not
a broader wildcard, and its capability list is pinned whole, because an
ADDED capability is what a presence check misses -- plus a test in path.rs
pinning MOUNT/AGENT_PREFIX and naming the nix file, since renaming either
constant is a silent 403 rather than a compile error.

setup.md carried two warnings this makes false: that nothing in the tree had
ever authenticated to the store, and that no deployment shape mints a leaf
whose CN reads swarm-controller. glue-bao-tls.nix has minted one since #3726
item 1.

swarm-secret-client/src/path.rs

@@ -98,4 +98,15 @@ mod tests {
             "got {e:?}"
         );
     }
+
+    #[test]
+    fn the_bao_policy_grants_exactly_these_two_values() {
+        // Renaming either constant is a silent 403 at provision time, not a
+        // compile error: the controller's grant spells them out in
+        // `nix/host-modules/swarm-bao.nix` (`controllerPolicyText`), which no
+        // Rust change can reach. Editing here means editing there, and
+        // `nix/module-eval.nix` asserts the other side of the same pair.
+        assert_eq!(MOUNT, "secret");
+        assert_eq!(AGENT_PREFIX, "swarm/agents");
+    }
 }