swarm CA: describe the store's pki root as the only anchor in docs and comments

The docs, option descriptions and comments that named the swarm root, the
swarm CA or the hive CA as an existing trust anchor now name the secret
store's pki root or the trust bundle that holds it:

- docs/swarm/README.md, secrets.md, bao.md
- deploy.bao.clientCaFile's and gateway.verifiedProxyTo's descriptions
- comments in hive-c0re/src/meta.rs, hive-agent/src/swarm_queue.rs,
  swarm-logs/src/auth.rs, swarm-controller/src/vcs_metrics.rs,
  hive-forge, swarm-authelia, swarm-ci-runner, glue-bao-tls, swarm-bao,
  swarm-grafana, swarm-otel, otel, hive-c0re, lib/hive-ca-trust.nix,
  hive-forge/Cargo.toml and the flake-update workflow

Nothing behaves differently: every edit is a nix, Rust or TOML comment, an
option description, or a test assertion message. The Rust edits change the
workspace source, which this PR already rebuilds for hivectl.

Refs #4588

nix/host-modules/lib/hive-ca-trust.nix

@@ -1,4 +1,4 @@
-# Shared hive-CA trust plumbing for containers that must trust the
+# Shared trust-bundle plumbing for containers that must trust the
 # self-signed gateway/forge leaf for *outbound* TLS (webhook delivery,
 # CI artifact upload, …). The anchors exist only at runtime — the host
 # `hive-tls-ca.service` (see `hive-tls.nix`) assembles them into
@@ -11,7 +11,7 @@
 # *consumption* differs per runtime: an additive variable (Node's
 # `NODE_EXTRA_CA_CERTS`, swarm-ci-runner) points straight at `caContainerPath` from
 # the call site, while a *replacing* one (Go's `SSL_CERT_FILE`, rustls) needs
-# the system-CAs+hive-CA concat that `trustBundle` below does for it.
+# the system-CAs+bundle concat that `trustBundle` below does for it.
 #
 # Pure function — NOT a NixOS module (don't add it to the host-modules
 # aggregator). Call it from a module's `let`:
@@ -93,7 +93,7 @@ in
     requires = [ "hive-tls-ca.service" ];
   };
 
-  # System CAs + hive CA in one bundle, with `SSL_CERT_FILE` set on each
+  # System CAs + the trust bundle in one file, with `SSL_CERT_FILE` set on each
   # consumer — for runtimes whose trust variable *replaces* the store (Go,
   # rustls-native-certs). An additive one (Node's `NODE_EXTRA_CA_CERTS`,
   # swarm-ci-runner) needs no bundle and should not use this.