agents fetch the hive CA from bao at boot instead of the meta flake embedding it

docs/networking/gateway.md

@@ -83,7 +83,7 @@ The issuer is the **secret store's `pki` mount**, not a bare self-signed leaf. `
 
 **Why an issuer, not a bare leaf**: a bare self-signed leaf is its own trust anchor, so every regeneration is a new anchor every consumer must re-trust, and an agent's build sets its trust store once, before any leaf exists. Agents and federation peers trust the store's root once; leaf rotation never breaks them.
 
-**What consumers trust**: `trust-bundle.pem` in the same state dir. It carries the store's `pki` root ([`swarm/ca.md`](../swarm/ca.md#the-trust-bundle)). nginx serves the leaf alone, since its issuer is a self-signed root. Agents (via `security.pki.certificateFiles`), the CI and forge containers and federating peers all read the bundle.
+**What consumers trust**: `trust-bundle.pem` in the same state dir. It carries the store's `pki` root ([`swarm/ca.md`](../swarm/ca.md#the-trust-bundle)). nginx serves the leaf alone, since its issuer is a self-signed root. The CI and forge containers and federating peers read the bundle. Agents fetch the root from the store themselves ([`swarm/ca.md`](../swarm/ca.md#distributing-the-root)).
 
 **Why on by default**: matrix-dart-sdk (FluffyChat's SDK) fetches `https://<host>/.well-known/matrix/client` and never falls back to plain http, so without TLS the browser client can't bootstrap.
 

docs/swarm/ca.md

@@ -240,14 +240,10 @@ naming, because it's subtle and it bites at a distance:
 > the store's root.** The derivation reads `security.pki.certificateFiles`
 > inside itself; the root doesn't exist there.
 
-Two consumers, and only one of them is fine:
+Two consumers, both reading the root at runtime:
 
-- **`hive-tls.nix` covers agents.** It folds the root into this hive's
-  `trust-bundle.pem`, `glue-hive-tls-controllers.nix` hands hive-c0re that
-  path as `HIVE_TLS_CA_PATH`, and the meta-flake renderer embeds that one
-  file next to every agent's flake. The bundle is the runtime-to-build-time
-  bridge.
-- **The Matrix container crosses the same bridge**, via the shared
+- **Agents fetch it themselves.** `hive-agent-trust-bundle.service` (`nix/agent-modules/hive-ca.nix`) reads `<mount>/ca/pem` from the store with the agent's own store certificate, then writes `/run/hive-agent-trust-bundle/bundle.pem` (system CAs plus the root) and `root.pem` (the root alone). The agent's units point `SSL_CERT_FILE` at the first (Rust, Go and OpenSSL clients) and `NODE_EXTRA_CA_CERTS` at the second (Node and Claude Code), and order after the unit with `Requires=`. The meta flake names no CA file, and a timer re-reads the root hourly. A consumer reads it at start, so a rotated root reaches an agent unit at its next start.
+- **The Matrix container gets a bind mount**, via the shared
   `lib/hive-ca-trust.nix` helper that `hive-forge` and `swarm-ci-runner`
   use: the bundle is bind-mounted read-only into the container, and a
   oneshot concatenates it with the system CAs before tuwunel starts.

docs/swarm/secrets.md

@@ -590,8 +590,8 @@ The store's `swarm-services` role issues them instead, from the root inside its
 certificate is the only anchor the swarm has. Each hive fetches the certificate
 from the store at boot, so nothing build-time can name it — the system reads
 `security.pki.certificateFiles`' value at build time, which makes it the wrong
-tool here. Trust reaches containers through a bind-mounted bundle assembled at
-boot instead.
+tool here. Host containers get a bind-mounted bundle assembled at boot; an
+agent fetches the root itself with its own store certificate.
 
 ## Adding a secret