swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

hive-c0re/src/forge/users.rs

@@ -38,13 +38,10 @@ fn core_avatar_png_path() -> std::path::PathBuf {
     std::path::PathBuf::from(dir).join("branding/hyperhive.png")
 }
 
-/// Bootstrap `core` token scopes — adds `read:admin,write:admin` on
-/// top of the agent scopes (swarm-controller's `AGENT_TOKEN_SCOPES`)
-/// so the host daemon can drive `/api/v1/admin/*`. Site-admin
-/// membership alone isn't enough: the token's own scope gate runs
-/// before the user-permission check.
-/// See `docs/integrations/forge.md::Token scopes`.
-const CORE_TOKEN_SCOPES: &str = "read:admin,write:admin,read:user,write:user,read:notification,write:notification,write:repository,write:issue,write:organization,write:misc";
+/// Bootstrap `core` token scopes — the same set as swarm-controller's
+/// `AGENT_TOKEN_SCOPES`, with no admin scope: nothing in hive-c0re calls
+/// `/api/v1/admin/*`. See `docs/integrations/forge.md::Token scopes`.
+const CORE_TOKEN_SCOPES: &str = "read:user,write:user,read:notification,write:notification,write:repository,write:issue,write:organization,write:misc";
 
 /// Pull the access token out of forgejo's success message. Format
 /// has shifted across versions (table form vs. "Access token was
@@ -197,9 +194,7 @@ pub(super) async fn ensure_core_avatar(token: &str) -> Result<()> {
 /// Outcome of probing whether the persisted core token still works
 /// against the *current* forge. Existence on disk is not validity: a
 /// token minted before a forge rebuild / re-provision is unknown to the
-/// new forge's DB and 401s on every call — which silently breaks the
-/// hive-ci runner-registration prefetch (it reads this same token to
-/// fetch a runner registration token).
+/// new forge's DB and 401s on every call.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum CoreTokenCheck {
     /// Token authenticated successfully — keep using it.
@@ -260,8 +255,8 @@ async fn check_core_token(token: &str) -> CoreTokenCheck {
 
 /// Ensure the bootstrap `core` admin user + a token at
 /// `CORE_TOKEN_PATH`. The token is what hive-c0re uses for forgejo
-/// API calls (org creation, meta-repo push, and the hive-ci
-/// runner-registration prefetch). Returns the token.
+/// API calls (meta-repo push, collaborator grants, PR comments).
+/// Returns the token.
 ///
 /// Idempotent, but validity-aware: when a token file is already present
 /// it is **probed against the current forge** before being trusted. A