swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

hive-priv-sock/src/lib.rs

@@ -45,7 +45,7 @@ pub const AGENT_PREFIX: &str = "h-";
 /// [`PrivRequest::ControlInfraContainer`], and it has one variant more than
 /// this list (the gateway). Keep the distinction — a name that belongs to
 /// no container has no business reaching a `-M` / `nixos-container` call.
-pub const SIBLING_CONTAINERS: &[&str] = &["hive-forge", "hive-matrix", "hive-ci"];
+pub const SIBLING_CONTAINERS: &[&str] = &["hive-forge", "hive-matrix"];
 
 /// Lifecycle verb for [`PrivRequest::ControlInfraContainer`]. Maps directly
 /// to `systemctl <verb> <unit>`, where the unit comes from
@@ -75,14 +75,13 @@ impl InfraAction {
 /// unknown or unsafe target — notably `hive-c0re`, which has no variant and
 /// would sever the daemon socket — is *unrepresentable* rather than caught
 /// by a runtime check. The c0re↔hive-priv wire form uses serde's default
-/// variant naming (`"Ci"`, `"Forge"`, …); it's an internal protocol (both
+/// variant naming (`"Forge"`, `"Gateway"`, …); it's an internal protocol (both
 /// ends rebuild together) so it needn't match the container name.
 /// [`name`](Self::name) is the separate stable identity string
-/// (`hive-ci`), and [`service_unit`](Self::service_unit) the systemd unit
+/// (`hive-forge`), and [`service_unit`](Self::service_unit) the systemd unit
 /// it actually resolves to.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub enum InfraContainer {
-    Ci,
     Forge,
     Gateway,
     Matrix,
@@ -108,23 +107,21 @@ impl InfraContainer {
     /// Every controllable infra target. A superset of
     /// [`SIBLING_CONTAINERS`] — not all of these are containers (see the
     /// test).
-    pub const ALL: [InfraContainer; 4] = [
-        InfraContainer::Ci,
+    pub const ALL: [InfraContainer; 3] = [
         InfraContainer::Forge,
         InfraContainer::Gateway,
         InfraContainer::Matrix,
     ];
 
-    /// Stable identity string, e.g. `hive-ci`. This is what the operator
+    /// Stable identity string, e.g. `hive-forge`. This is what the operator
     /// types, what the dashboard displays, and what [`FromStr`](std::str::FromStr)
     /// parses — it stays `hive-gateway` even though the gateway is no
     /// longer a container, because it names the *service*, not its
     /// implementation. (Distinct from the serde wire form, which is the
-    /// default variant name `"Ci"`.)
+    /// default variant name `"Forge"`.)
     #[must_use]
     pub fn name(self) -> &'static str {
         match self {
-            InfraContainer::Ci => "hive-ci",
             InfraContainer::Forge => "hive-forge",
             InfraContainer::Gateway => "hive-gateway",
             InfraContainer::Matrix => "hive-matrix",
@@ -153,7 +150,7 @@ impl InfraContainer {
 impl std::str::FromStr for InfraContainer {
     type Err = ();
 
-    /// Parse an infra name (`hive-ci`, …) into a variant. `Err(())` for
+    /// Parse an infra name (`hive-forge`, …) into a variant. `Err(())` for
     /// anything that isn't one.
     fn from_str(s: &str) -> Result<Self, ()> {
         Self::ALL.into_iter().find(|c| c.name() == s).ok_or(())
@@ -478,19 +475,6 @@ pub enum PrivRequest {
         paused: bool,
     },
 
-    /// Register the hive-ci Forgejo Actions runner: write the registration
-    /// token to the host-side `/run/hive-ci/runner-token` env-file (root-owned,
-    /// bind-mounted read-only into the container) as `TOKEN=<token>`, then
-    /// `systemctl --machine=hive-ci restart gitea-runner-hive.service` so the
-    /// runner picks up the credential. hive-c0re holds the forge admin token
-    /// and mints the registration token; only the registration token is written
-    /// here, and only to a host path — the admin token never enters the
-    /// container. The token is validated single-line + non-empty root-side.
-    RegisterCiRunner {
-        /// Forge runner registration token minted by hive-c0re.
-        token: String,
-    },
-
     /// Start / stop a hive infrastructure container on the host via
     /// `systemctl <action> container@<container>.service`. The
     /// [`InfraContainer`] enum is the allowlist — serde rejects unknown /
@@ -810,8 +794,8 @@ mod tests {
     #[test]
     fn service_unit_wraps_containers_but_not_host_units() {
         assert_eq!(
-            InfraContainer::Ci.service_unit(),
-            "container@hive-ci.service"
+            InfraContainer::Forge.service_unit(),
+            "container@hive-forge.service"
         );
         assert_eq!(InfraContainer::Gateway.service_unit(), "nginx.service");
     }