swarm CA: describe the store's pki root as the only anchor in docs and comments

The docs, option descriptions and comments that named the swarm root, the
swarm CA or the hive CA as an existing trust anchor now name the secret
store's pki root or the trust bundle that holds it:

- docs/swarm/README.md, secrets.md, bao.md
- deploy.bao.clientCaFile's and gateway.verifiedProxyTo's descriptions
- comments in hive-c0re/src/meta.rs, hive-agent/src/swarm_queue.rs,
  swarm-logs/src/auth.rs, swarm-controller/src/vcs_metrics.rs,
  hive-forge, swarm-authelia, swarm-ci-runner, glue-bao-tls, swarm-bao,
  swarm-grafana, swarm-otel, otel, hive-c0re, lib/hive-ca-trust.nix,
  hive-forge/Cargo.toml and the flake-update workflow

Nothing behaves differently: every edit is a nix, Rust or TOML comment, an
option description, or a test assertion message. The Rust edits change the
workspace source, which this PR already rebuilds for hivectl.

Refs #4588

nix/host-modules/glue-bao-tls.nix

@@ -13,10 +13,10 @@
 # handed. A deployment with a real internal CA drops this file and names its
 # own paths; nothing in the store changes.
 #
-# ⚠️ Not the hive CA and not the swarm CA. The store will eventually
-# distribute both, and an authority you must already hold a certificate from
-# cannot be one the store hands out — reach the store to get the CA material,
-# need a cert from that CA to reach the store. This CA signs a fixed, short
+# ⚠️ Not the store's `pki` root, which the store distributes. An authority
+# you must already hold a certificate from cannot be one the store hands
+# out — reach the store to get the CA material, need a cert from that CA to
+# reach the store. This CA signs a fixed, short
 # list of leaves and distributes nothing, so it cannot enter that cycle.
 #
 # ⚠️ Files like this are the only place a `deploy.<foo>` value may derive from