swarm CA: describe the store's pki root as the only anchor in docs and comments

The docs, option descriptions and comments that named the swarm root, the
swarm CA or the hive CA as an existing trust anchor now name the secret
store's pki root or the trust bundle that holds it:

- docs/swarm/README.md, secrets.md, bao.md
- deploy.bao.clientCaFile's and gateway.verifiedProxyTo's descriptions
- comments in hive-c0re/src/meta.rs, hive-agent/src/swarm_queue.rs,
  swarm-logs/src/auth.rs, swarm-controller/src/vcs_metrics.rs,
  hive-forge, swarm-authelia, swarm-ci-runner, glue-bao-tls, swarm-bao,
  swarm-grafana, swarm-otel, otel, hive-c0re, lib/hive-ca-trust.nix,
  hive-forge/Cargo.toml and the flake-update workflow

Nothing behaves differently: every edit is a nix, Rust or TOML comment, an
option description, or a test assertion message. The Rust edits change the
workspace source, which this PR already rebuilds for hivectl.

Refs #4588

nix/host-modules/hive-c0re/default.nix

@@ -136,9 +136,9 @@ in
     # ⚠️ `SSL_CERT_FILE` REPLACES the trust store, and unlike the other
     # consumers of this helper, hive-c0re already makes a *public*-TLS call:
     # the OTEL exporter reaches whatever `otel.endpoint` names, typically a
-    # normal internet host. The bundle is system CAs + hive CA precisely so
-    # that path keeps working — narrowing it to the hive CA alone would fix
-    # a case nobody hits yet and break one that runs today.
+    # normal internet host. The bundle is system CAs + the store's root
+    # precisely so that path keeps working — narrowing it to the store's root
+    # alone would fix a case nobody hits yet and break one that runs today.
     (caTrust.trustBundle {
       inherit pkgs;
       name = "hive-c0re";