glue-matrix-bao-token: say why the store returned nothing

The reader had one failure branch, and it could not fail. It named three
states — the store holds nothing, the store is sealed, the store is
unreachable — treated all three as success, and sent bao's stderr to
/dev/null, which is the only thing that tells them apart.

The degraded mode is right and is unchanged: a missing registration token
means new agent accounts cannot be provisioned and nothing else breaks,
so this still exits 0 and leaves the local token alone. What changes is
that the journal now carries the store's own message instead of a
sentence of ours asserting all three at once.

Deliberately not branching on that message. Distinguishing "no value
found" from "permission denied" programmatically would mean matching
prose from an external tool that I cannot reach a live instance of to
confirm, which is inventing a discriminator rather than reporting one.

Nothing asserted this script before — eleven module-eval cases cover the
unit's existence and its ordering, none its contents, which is how the
branch stayed. The case added here covers the property that was missing.

Gated: `96 module properties hold`, exit 0 (95 on the base commit, +1 =
the case added). `nix fmt` reported 0 changed over 723 files emitted in a
fresh worktree. Tracker-tag, comment-block and doc-pointer lints all exit
0 after staging.

nix/host-modules/glue-matrix-bao-token.nix

@@ -103,9 +103,22 @@ in
         # store can answer". `TimeoutStartSec` above is the bound; the
         # homeserver only `Wants=` this unit, so hitting it degrades to
         # keeping the local token rather than holding up the container.
-        if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>/dev/null)"; then
-          echo "swarm-bao holds no ${tokenPath}, or is sealed/unreachable." >&2
-          echo "Keeping the token hive-matrix already has." >&2
+        # `bao`'s own message is the only thing separating a missing value
+        # from a refused identity from an unreachable host. This unit's
+        # degraded mode is correct for all three, so it reports which one
+        # rather than asserting all three in a sentence of ours — a reader
+        # that cannot say why it read nothing is indistinguishable from a
+        # broken one.
+        err="$(mktemp)"
+        trap 'rm -f "$err"' EXIT
+
+        if ! token="$(bao kv get -field=value ${lib.escapeShellArg tokenPath} 2>"$err")"; then
+          echo "swarm-bao did not return ${tokenPath}; keeping the token hive-matrix already has." >&2
+          if [ -s "$err" ]; then
+            cat "$err" >&2
+          else
+            echo "bao failed without writing a diagnostic." >&2
+          fi
           exit 0
         fi
 

nix/module-eval.nix

@@ -1556,6 +1556,18 @@ let
         in
         s ? swarm-bao-matrix-token && s.swarm-bao-matrix-token.requires == [ "swarm-bao-pki.service" ];
     }
+    {
+      # Nothing asserted this script before, which is how it kept a branch that
+      # named three states and threw away the only thing telling them apart. A
+      # missing value, a refused identity and an unreachable host all end in the
+      # same degraded mode here, correctly — what must survive is which one.
+      name = "the matrix token reader carries the store's own diagnostic into the journal";
+      ok =
+        let
+          s = baoWithMatrix.systemd.services.swarm-bao-matrix-token.script;
+        in
+        !(lib.hasInfix "2>/dev/null" s) && lib.hasInfix ''cat "''$err"'' s;
+    }
     {
       # hive-c0re runs as hive-core and the client key is `0600` root-owned
       # inside a `0700` directory, so the identity reaches the daemon as a