swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

hive-c0re/src/forge/mod.rs

@@ -4,7 +4,6 @@
 //! teams and repos).
 //! No-op when `hive-forge` isn't running. Full design: `docs/integrations/forge.md`.
 
-mod ci_runner;
 mod pr_comment;
 mod reconcile;
 mod repos;
@@ -233,8 +232,8 @@ pub async fn sync_agent(name: &str, core_token: Option<&str>) -> bool {
 }
 
 /// The `core_token.is_some()` half of [`ensure_all`]: the meta repo, the
-/// local knowledge clone, the core avatar, CI runner registration, and
-/// removing this hive's own config-PR hook —
+/// local knowledge clone, the core avatar, and removing this hive's own
+/// config-PR hook —
 /// every step that needs an authenticated forge client. The swarm-wide
 /// objects (orgs, the `operators` team, mirrors, `internal/docs`,
 /// `internal/knowledge`, the `agent-configs` avatar) are the
@@ -271,9 +270,6 @@ async fn ensure_all_orgs_and_repos(token: &str) {
             format!("forge: core avatar upload failed: {e}"),
         );
     }
-    // Register the hive-ci Actions runner (off the container's boot path;
-    // no-op when CI is disabled or the runner already holds valid creds).
-    ci_runner::ensure_ci_runner_registered(token).await;
     if let Err(e) = remove_config_pr_webhook(token).await {
         tracing::warn!(error = ?e, "forge: remove_config_pr_webhook failed");
     }