swarm CA: describe the store's pki root as the only anchor in docs and comments

The docs, option descriptions and comments that named the swarm root, the
swarm CA or the hive CA as an existing trust anchor now name the secret
store's pki root or the trust bundle that holds it:

- docs/swarm/README.md, secrets.md, bao.md
- deploy.bao.clientCaFile's and gateway.verifiedProxyTo's descriptions
- comments in hive-c0re/src/meta.rs, hive-agent/src/swarm_queue.rs,
  swarm-logs/src/auth.rs, swarm-controller/src/vcs_metrics.rs,
  hive-forge, swarm-authelia, swarm-ci-runner, glue-bao-tls, swarm-bao,
  swarm-grafana, swarm-otel, otel, hive-c0re, lib/hive-ca-trust.nix,
  hive-forge/Cargo.toml and the flake-update workflow

Nothing behaves differently: every edit is a nix, Rust or TOML comment, an
option description, or a test assertion message. The Rust edits change the
workspace source, which this PR already rebuilds for hivectl.

Refs #4588

swarm-controller/src/vcs_metrics.rs

@@ -155,11 +155,11 @@ fn build_provider(interval: Duration) -> Result<SdkMeterProvider> {
 /// No CA handling here unlike [`swarm_queue_client::QueueConfig::ca_file`]
 /// (which `mint_token_for_blocking` already applies to the TOKEN endpoint
 /// internally): the metrics endpoint is reached through the gateway with a
-/// certificate the swarm CA issued, and this whole process already trusts
-/// that CA via `SSL_CERT_FILE` (`hive-ca-trust.nix`, applied host-wide to
-/// this unit for the same reason the forge client needs no special
-/// handling either) — a second, narrower trust bundle here would just be
-/// the same fact stated twice.
+/// certificate the store's `pki` mount issued, and this whole process
+/// already trusts that mount's root via `SSL_CERT_FILE` (`hive-ca-trust.nix`,
+/// applied host-wide to this unit for the same reason the forge client needs
+/// no special handling either) — a second, narrower trust bundle here would
+/// just be the same fact stated twice.
 pub(crate) fn authenticated_http_client() -> Result<crate::otel_http_client::AuthenticatedHttpClient>
 {
     let cfg = crate::queue_identity::get().cloned().ok_or_else(|| {