swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

frontend/packages/dashboard/src/core.html

@@ -20,7 +20,7 @@
        /builds.html (the build lifecycle hub). Default tab: K3PT ST4T3.
        The section <div> ids (tombstones-section, container-load-section)
        match what core.js's renderers target. Hive infra containers
-       (`hive-ci`, `hive-forge`, `hive-gateway`, `hive-matrix`) have no
+       (`hive-forge`, `hive-gateway`, `hive-matrix`) have no
        dashboard panel — `hivectl stop`/`start`/`restart` is the only
        control surface. -->
     <header class="page-header">

frontend/packages/dashboard/src/logs.html

@@ -60,11 +60,11 @@ select an agent above</pre
         >
       </section>
 
-      <!-- INFRA: journald viewer for infrastructure containers (hive-ci,
-         hive-forge, hive-gateway, hive-matrix). Always fetches the full
+      <!-- INFRA: journald viewer for infrastructure containers (hive-forge,
+         hive-gateway, hive-matrix). Always fetches the full
          machine journal — no unit filter (infra containers don't run the
          per-agent hive daemons). Backed by GET /api/journal/{name}?lines=N.
-         Deep-link: ?agent=hive-ci routes here instead of the AGENT tab. -->
+         Deep-link: ?agent=hive-forge routes here instead of the AGENT tab. -->
       <section
         class="logs-pane"
         id="logs-pane-infra"

frontend/packages/dashboard/src/logs.js

@@ -1,7 +1,7 @@
 // /logs.html entry point: log viewer with three sub-tabs (AGENT, INFRA,
 // SYSTEM). Build log history lives at /builds.html, not here.
 // AGENT  — per-container journald viewer, backed by GET /api/journal/{name}
-// INFRA  — infra-container journald viewer (hive-ci, hive-forge, …),
+// INFRA  — infra-container journald viewer (hive-forge, hive-gateway, …),
 //          same API but full machine journal only (no unit filter)
 // SYSTEM — host service logs, backed by GET /api/journal-host
 //
@@ -89,7 +89,7 @@ import "@hive/shared/hive-tab-strip.js";
   if (agentRefresh) agentRefresh.addEventListener("click", fetchAgent);
 
   // ─── INFRA tab ────────────────────────────────────────────────────────
-  // Infra containers (hive-ci, hive-forge, hive-gateway, hive-matrix) don't
+  // Infra containers (hive-forge, hive-gateway, hive-matrix) don't
   // run the per-agent hive daemons, so the unit filter is inapplicable. We
   // always fetch the full machine journal for them.
 
@@ -138,11 +138,11 @@ import "@hive/shared/hive-tab-strip.js";
   if (infraSelect) infraSelect.addEventListener("change", fetchInfra);
   if (infraRefresh) infraRefresh.addEventListener("click", fetchInfra);
 
-  // Fixed allowlist — the four hive infra services never change at
+  // Fixed allowlist — the three hive infra services never change at
   // runtime, and there's no dashboard API exposing just the name list
   // (the one that used to, `/api/state`'s `infra_containers` field, was
   // start/stop-panel-only and is gone). Mirrors `hive_priv_sock::InfraContainer::ALL`.
-  const INFRA_NAMES = ["hive-ci", "hive-forge", "hive-gateway", "hive-matrix"];
+  const INFRA_NAMES = ["hive-forge", "hive-gateway", "hive-matrix"];
 
   // ─── container list init ──────────────────────────────────────────────
   // Fetch /api/state once to populate the AGENT selector (agents only);