swarm CA: describe the store's pki root as the only anchor in docs and comments

The docs, option descriptions and comments that named the swarm root, the
swarm CA or the hive CA as an existing trust anchor now name the secret
store's pki root or the trust bundle that holds it:

- docs/swarm/README.md, secrets.md, bao.md
- deploy.bao.clientCaFile's and gateway.verifiedProxyTo's descriptions
- comments in hive-c0re/src/meta.rs, hive-agent/src/swarm_queue.rs,
  swarm-logs/src/auth.rs, swarm-controller/src/vcs_metrics.rs,
  hive-forge, swarm-authelia, swarm-ci-runner, glue-bao-tls, swarm-bao,
  swarm-grafana, swarm-otel, otel, hive-c0re, lib/hive-ca-trust.nix,
  hive-forge/Cargo.toml and the flake-update workflow

Nothing behaves differently: every edit is a nix, Rust or TOML comment, an
option description, or a test assertion message. The Rust edits change the
workspace source, which this PR already rebuilds for hivectl.

Refs #4588

docs/swarm/bao.md

@@ -106,7 +106,7 @@ itself, plus a pair for every principal it runs — see
 The operator issues those leaves out of band; they're the credentials the
 store can't hand you, being what opens it.
 
-⚠️ Not the gateway's HTTPS certificates and not the hive CA — this is **mTLS
+⚠️ Not the gateway's HTTPS certificates and not the store's `pki` root — this is **mTLS
 between services and the store**, a separate trust domain, because a store
 that took its identity from an authority it itself distributes could never
 come up before that authority.