swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

hive-host-sock/src/lib.rs

@@ -387,12 +387,12 @@ pub struct QuotaRow {
 /// (the bare `hivectl stop` / `start`); set individual fields to restrict
 /// (e.g. only `agents` → just the sub-agent containers). `agents` covers
 /// every managed sub-agent container; the rest are the named infra
-/// services (`hive-ci`, `hive-forge`, `hive-gateway`, `hive-matrix`) —
+/// services (`hive-forge`, `hive-gateway`, `hive-matrix`) —
 /// containers, bar the gateway, which is the host's nginx unit.
 //
 // A flat bag of independent flag toggles — one bool per selectable
 // container class — is exactly the right shape here: each maps 1:1 to a
-// `hivectl` `--ci` / `--forge` / `--gateway` / `--matrix` flag, and they're
+// `hivectl` `--forge` / `--gateway` / `--matrix` flag, and they're
 // orthogonal (any subset is valid), so a state machine or two-variant enums
 // would only obscure the mapping. Hence the `struct_excessive_bools` allow.
 #[allow(clippy::struct_excessive_bools)]
@@ -407,8 +407,6 @@ pub struct LifecycleScope {
     #[serde(default)]
     pub agent_names: Vec<String>,
     #[serde(default)]
-    pub ci: bool,
-    #[serde(default)]
     pub forge: bool,
     #[serde(default)]
     pub gateway: bool,
@@ -421,8 +419,7 @@ impl LifecycleScope {
     /// classes" (the bare `hivectl stop` / `start` with no scope flags).
     #[must_use]
     pub fn is_everything(&self) -> bool {
-        !(self.agents || self.ci || self.forge || self.gateway || self.matrix)
-            && self.agent_names.is_empty()
+        !(self.agents || self.forge || self.gateway || self.matrix) && self.agent_names.is_empty()
     }
 }