swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

docs/swarm/secrets.md

@@ -302,7 +302,7 @@ next controller restart.
 ### Per-principal identities
 
 Bao matches a cert-auth role on the certificate's subject, so a certificate is an
-identity and sharing one merges the identities. These four units read one path
+identity and sharing one merges the identities. These five units read one path
 each and each holds a leaf, a role and a policy of its own:
 
 | unit                       | option pair under `deploy.bao.`                              | reads                                                    |
@@ -311,20 +311,23 @@ each and each holds a leaf, a role and a policy of its own:
 | `swarm-bao-grafana-oidc`   | `grafanaOidcClientCertFile` / `grafanaOidcClientKeyFile`     | `swarm/services/<grafana client id>/oidc/client`         |
 | `swarm-bao-otel-oidc`      | `otelOidcClientCertFile` / `otelOidcClientKeyFile`           | `swarm/services/<collector client id>/oidc/client`       |
 | `swarm-bao-forwarder-oidc` | `forwarderOidcClientCertFile` / `forwarderOidcClientKeyFile` | `swarm/services/<store forwarder client id>/oidc/client` |
+| `swarm-bao-ci-runner`      | `ciRunnerClientCertFile` / `ciRunnerClientKeyFile`           | `swarm/services/ci-runner/registration-token`            |
 
 The first exists **per hive**, because the path it reads carries a hive name
 and every hive runs its own reader. Its subject is
 `<deploy.bao.queueAgentCommonNamePrefix>-<hive>`; `swarm.nix` reserves that
 composed spelling as a hive name, so nobody can name a hive into another hive's
-role. The other three read a path that names a swarm service rather than a hive,
+role. The other four read a path that names a swarm service rather than a hive,
 so one role each is enough and their subjects are the flat
-`deploy.bao.grafanaOidcCommonName`, `deploy.bao.otelOidcCommonName` and
-`deploy.bao.forwarderOidcCommonName`.
+`deploy.bao.grafanaOidcCommonName`, `deploy.bao.otelOidcCommonName`,
+`deploy.bao.forwarderOidcCommonName` and `deploy.bao.ciRunnerCommonName`.
 
-On a host that mints its own PKI, `glue-bao-tls.nix` signs all four and defaults
-all eight options, and there is nothing to do. Elsewhere you issue each leaf from
+On a host that mints its own PKI, `glue-bao-tls.nix` signs all five and defaults
+all ten options, and there is nothing to do. Elsewhere you issue each leaf from
 that CA out of band and name it here — one file per principal rather than one file
-shared by four, which is the whole of what this buys.
+shared by five, which is the whole of what this buys. `swarm-ci-runner.nix`
+refuses the build wherever the runner runs without its pair, as
+`swarm-grafana.nix` does for Grafana.
 
 On a host without the store, where the forwarder never runs, forgetting one of
 the other six isn't a quiet degrade. A hand-configured remote-store hive that