swarm CA: describe the store's pki root as the only anchor in docs and comments

The docs, option descriptions and comments that named the swarm root, the
swarm CA or the hive CA as an existing trust anchor now name the secret
store's pki root or the trust bundle that holds it:

- docs/swarm/README.md, secrets.md, bao.md
- deploy.bao.clientCaFile's and gateway.verifiedProxyTo's descriptions
- comments in hive-c0re/src/meta.rs, hive-agent/src/swarm_queue.rs,
  swarm-logs/src/auth.rs, swarm-controller/src/vcs_metrics.rs,
  hive-forge, swarm-authelia, swarm-ci-runner, glue-bao-tls, swarm-bao,
  swarm-grafana, swarm-otel, otel, hive-c0re, lib/hive-ca-trust.nix,
  hive-forge/Cargo.toml and the flake-update workflow

Nothing behaves differently: every edit is a nix, Rust or TOML comment, an
option description, or a test assertion message. The Rust edits change the
workspace source, which this PR already rebuilds for hivectl.

Refs #4588

nix/host-modules/swarm-bao.nix

@@ -1180,8 +1180,8 @@ let
   autheliaCfg = hyperhiveCfg.swarm.authelia;
 
   # Outbound TLS for that collector: it dials the swarm collector's gateway
-  # name and authelia's token endpoint, both leaves of the runtime-generated
-  # hive CA, which cannot be baked into a derivation. Same helper, same two
+  # name and authelia's token endpoint, both leaves under the store's runtime
+  # pki root, which cannot be baked into a derivation. Same helper, same two
   # halves and the same `SSL_CERT_FILE` consumption as ./swarm-otel.nix's own
   # container — a Go process whose trust variable REPLACES the store, which is
   # what the bundle (system CAs ++ our anchors) is for.
@@ -1374,10 +1374,9 @@ in
       description = ''
         Authority the store validates hive **client** certificates against.
 
-        This module declares no default and does not reach for the hive
-        CA: the hive CA is a future *consumer* of the store, so a store
-        that authenticated against it could not come up before the thing
-        it issues.
+        This module declares no default, and the store's own `pki` root
+        can't be this authority: a store that authenticated against a root
+        it issues could not come up before the thing it issues.
 
         On a hive that runs the store, a glue module supplies the CA it
         minted for exactly this, as a `mkDefault`. Point this at something
@@ -3430,7 +3429,7 @@ in
             isReadOnly = true;
           };
         }
-        # The hive CA, for the forwarder's two outbound calls: the swarm
+        # The trust bundle, for the forwarder's two outbound calls: the swarm
         # collector's gateway name and authelia's token endpoint. Empty when
         # the gateway is not self-signed, so the whole path drops out.
         // caTrust.bindMount;