glue-matrix-bao-token: say why the store returned nothing

The reader had one failure branch, and it could not fail. It named three
states — the store holds nothing, the store is sealed, the store is
unreachable — treated all three as success, and sent bao's stderr to
/dev/null, which is the only thing that tells them apart.

The degraded mode is right and is unchanged: a missing registration token
means new agent accounts cannot be provisioned and nothing else breaks,
so this still exits 0 and leaves the local token alone. What changes is
that the journal now carries the store's own message instead of a
sentence of ours asserting all three at once.

Deliberately not branching on that message. Distinguishing "no value
found" from "permission denied" programmatically would mean matching
prose from an external tool that I cannot reach a live instance of to
confirm, which is inventing a discriminator rather than reporting one.

Nothing asserted this script before — eleven module-eval cases cover the
unit's existence and its ordering, none its contents, which is how the
branch stayed. The case added here covers the property that was missing.

Gated: `96 module properties hold`, exit 0 (95 on the base commit, +1 =
the case added). `nix fmt` reported 0 changed over 723 files emitted in a
fresh worktree. Tracker-tag, comment-block and doc-pointer lints all exit
0 after staging.

nix/module-eval.nix

@@ -1556,6 +1556,18 @@ let
         in
         s ? swarm-bao-matrix-token && s.swarm-bao-matrix-token.requires == [ "swarm-bao-pki.service" ];
     }
+    {
+      # Nothing asserted this script before, which is how it kept a branch that
+      # named three states and threw away the only thing telling them apart. A
+      # missing value, a refused identity and an unreachable host all end in the
+      # same degraded mode here, correctly — what must survive is which one.
+      name = "the matrix token reader carries the store's own diagnostic into the journal";
+      ok =
+        let
+          s = baoWithMatrix.systemd.services.swarm-bao-matrix-token.script;
+        in
+        !(lib.hasInfix "2>/dev/null" s) && lib.hasInfix ''cat "''$err"'' s;
+    }
     {
       # hive-c0re runs as hive-core and the client key is `0600` root-owned
       # inside a `0700` directory, so the identity reaches the daemon as a