swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

nix/host-modules/hive-forge/default.nix

@@ -74,23 +74,18 @@ let
     "https://${cfg.domain}${portSuffix}/";
   effectiveRootUrl = if cfg.rootUrl != null then cfg.rootUrl else defaultRootUrl;
 
-  # When CI is enabled, the runner needs `actions/checkout` resolvable
-  # without external DNS (hive-ci shares the host netns, so a host-resolver
-  # blip otherwise reds every `actions/checkout@vN` fetch from
-  # data.forgejo.org). Auto-append a pull-mirror of it and point
-  # forgejo's DEFAULT_ACTIONS_URL at this instance so `uses:` resolves local.
-  ciEnabled = config.services.hyperhive.deploy.forgejo.ci.enable;
+  # `actionsFromSelf` resolves `uses:` against this forge, which then has to
+  # hold the action.
+  actionsFromSelf = deployCfg.forgejo.actionsFromSelf;
   actionCheckoutMirror = {
     upstream = "https://github.com/actions/checkout";
     dest = "actions/checkout";
   };
-  # Auto-append the actions/checkout mirror only when CI is on AND the
-  # operator hasn't already declared that dest themselves (else CI-on +
-  # an explicit `actions/checkout` entry would duplicate it).
+  # Unless the operator already declared that dest, which would duplicate it.
   effectiveMirrors =
     deployCfg.forgejo.mirrors
     ++ lib.optional (
-      ciEnabled && !(lib.any (m: m.dest == actionCheckoutMirror.dest) deployCfg.forgejo.mirrors)
+      actionsFromSelf && !(lib.any (m: m.dest == actionCheckoutMirror.dest) deployCfg.forgejo.mirrors)
     ) actionCheckoutMirror;
 
   # Share host netns — forgejo's HTTP / SSH listeners then look
@@ -179,12 +174,24 @@ in
         so a host-resolver blip leaves a *stale* mirror, never a hard
         failure on whatever reads it.
 
-        When `services.hyperhive.deploy.forgejo.ci.enable` is set, an
-        `actions/checkout` mirror is auto-appended to this list and
-        forgejo's `DEFAULT_ACTIONS_URL` is pointed at this instance, so CI
-        `uses: actions/checkout@vN` steps resolve entirely on loopback with
-        no external DNS on the critical path (the seed/re-sync needs
-        external DNS, but that's off the CI path).
+        With {option}`services.hyperhive.deploy.forgejo.actionsFromSelf`
+        set, an `actions/checkout` mirror is appended to this list.
+      '';
+    };
+
+    actionsFromSelf = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = ''
+        Resolve a workflow's `uses: <org>/<action>@vN` against this forge
+        instead of `data.forgejo.org`, and add an `actions/checkout`
+        pull-mirror to {option}`services.hyperhive.deploy.forgejo.mirrors`
+        so the checkout step has something to resolve to. A CI job's
+        checkout then needs no external DNS; only the mirror's re-sync
+        does.
+
+        Any other action a workflow names has to be mirrored here too.
       '';
     };
 
@@ -641,16 +648,16 @@ in
               # Enable Forgejo Actions so the runner registration token
               # API endpoint is available. Without this the endpoint
               # returns "runner registration token not found" regardless
-              # of token scopes. Required by `hive-ci-register.service`
-              # in the hive-ci container.
+              # of token scopes. swarm-controller's `forge::runner_token`
+              # reads it.
               actions.ENABLED = true;
-              # When CI is enabled, resolve `uses: <org>/<action>@vN` from
+              # With `actionsFromSelf`, resolve `uses: <org>/<action>@vN` from
               # THIS instance (the seeded `actions/checkout` pull-mirror)
               # instead of the upstream default `data.forgejo.org` — keeps
               # the checkout step on loopback, immune to a host-resolver
               # blip. `self` = forgejo expands actions against its
               # own ROOT_URL.
-              actions.DEFAULT_ACTIONS_URL = lib.mkIf ciEnabled "self";
+              actions.DEFAULT_ACTIONS_URL = lib.mkIf actionsFromSelf "self";
               # F3 (federation) computes its data dir relative to the
               # forgejo binary, which lands in the read-only nix
               # store and crashes anything that touches the F3
@@ -1099,7 +1106,7 @@ in
       lib.mkIf deployCfg.swarm-controller.enable (builtins.toJSON effectiveMirrors);
     warnings = lib.optional (effectiveMirrors != [ ] && !deployCfg.swarm-controller.enable) ''
       services.hyperhive.deploy.forgejo.mirrors (or the actions/checkout mirror
-      deploy.forgejo.ci.enable adds) is set on a host that does not run the
+      deploy.forgejo.actionsFromSelf adds) is set on a host that does not run the
       swarm-controller. The controller seeds mirrors from its own host's list,
       so these are not seeded: declare them on the swarm-controller's host.
     '';