swarm CA: describe the store's pki root as the only anchor in docs and comments

The docs, option descriptions and comments that named the swarm root, the
swarm CA or the hive CA as an existing trust anchor now name the secret
store's pki root or the trust bundle that holds it:

- docs/swarm/README.md, secrets.md, bao.md
- deploy.bao.clientCaFile's and gateway.verifiedProxyTo's descriptions
- comments in hive-c0re/src/meta.rs, hive-agent/src/swarm_queue.rs,
  swarm-logs/src/auth.rs, swarm-controller/src/vcs_metrics.rs,
  hive-forge, swarm-authelia, swarm-ci-runner, glue-bao-tls, swarm-bao,
  swarm-grafana, swarm-otel, otel, hive-c0re, lib/hive-ca-trust.nix,
  hive-forge/Cargo.toml and the flake-update workflow

Nothing behaves differently: every edit is a nix, Rust or TOML comment, an
option description, or a test assertion message. The Rust edits change the
workspace source, which this PR already rebuilds for hivectl.

Refs #4588

nix/host-modules/hive-forge/default.nix

@@ -428,7 +428,7 @@ in
       # --link-journal=try-guest, and EXTRA_NSPAWN_FLAGS expands after it.
       extraFlags = [ "--link-journal=host" ];
       inherit privateNetwork;
-      # Self-signed mode: bind the public hive CA cert read-only so forgejo
+      # Self-signed mode: bind the hive's trust bundle read-only so forgejo
       # can trust the gateway's self-signed leaf for outbound webhook
       # delivery. The bind-mount, the `container@` ordering and the bundle
       # the container's consumers read all come from the hive-ca-trust
@@ -480,12 +480,12 @@ in
 
             # Forgejo is Go, and `SSL_CERT_FILE` *replaces* the default store
             # rather than adding to it — so it needs the system CAs and the
-            # hive CA concatenated, not the CA alone, or public mirror fetches
-            # lose every anchor they had.
+            # store's root concatenated, not the root alone, or public mirror
+            # fetches lose every anchor they had.
             #
             # BOTH units that make an outbound HTTPS call are consumers, not
             # just the obvious one: `forgejo-sso-source` fetches the issuer's
-            # `.well-known/openid-configuration` over the swarm CA, and it
+            # `.well-known/openid-configuration` under the store's root, and it
             # once shipped without the trust its sibling had. `optional`
             # rather than a flat list because that unit only exists when SSO
             # is on — naming an absent unit would order nothing and quietly
@@ -801,7 +801,8 @@ in
             # container's `imports` above, which is where `SSL_CERT_FILE`
             # comes from): registering the login source makes an **outbound
             # HTTPS call** to `<issuer>/.well-known/openid-configuration`,
-            # served under the swarm CA the default store has never heard of.
+            # served under the store's `pki` root, which the default store has
+            # never heard of.
             # It once shipped without the trust `forgejo.service` had, and
             # failed every single time with `x509: certificate signed by
             # unknown authority`. The trust belongs to every process that