swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

nix/host-modules/lib/hive-ca-trust.nix

@@ -9,7 +9,7 @@
 #
 # `bindMount` + `containerOrdering` are the language-agnostic half. The
 # *consumption* differs per runtime: an additive variable (Node's
-# `NODE_EXTRA_CA_CERTS`, hive-ci) points straight at `caContainerPath` from
+# `NODE_EXTRA_CA_CERTS`, swarm-ci-runner) points straight at `caContainerPath` from
 # the call site, while a *replacing* one (Go's `SSL_CERT_FILE`, rustls) needs
 # the system-CAs+hive-CA concat that `trustBundle` below does for it.
 #
@@ -19,7 +19,7 @@
 #   caTrust = import ./lib/hive-ca-trust.nix { inherit lib tlsCfg gatewayCfg; };
 #   # then, in the container:
 #   #   bindMounts = { … } // caTrust.bindMount;
-#   #   systemd.services."container@hive-ci" = lib.mkMerge [ caTrust.containerOrdering … ];
+#   #   systemd.services."container@swarm-ci-runner" = lib.mkMerge [ caTrust.containerOrdering … ];
 #   #   environment.NODE_EXTRA_CA_CERTS = caTrust.caContainerPath;  # consumption, per-caller
 #
 # `tlsCfg`     = config.services.hyperhive.deploy.hive-controller.tls
@@ -87,7 +87,7 @@ in
   };
 
   # Fold into the caller's `container@<name>` unit (via `lib.mkMerge` if the
-  # caller adds its own keys, e.g. hive-ci's `TimeoutStartSec`). Orders the
+  # caller adds its own keys). Orders the
   # container after the host `hive-tls-ca.service` so the bind source exists
   # before nspawn sets the mount up — a condition-skipped/late CA would
   # otherwise fail the container start.
@@ -99,7 +99,7 @@ in
   # System CAs + hive CA in one bundle, with `SSL_CERT_FILE` set on each
   # consumer — for runtimes whose trust variable *replaces* the store (Go,
   # rustls-native-certs). An additive one (Node's `NODE_EXTRA_CA_CERTS`,
-  # hive-ci) needs no bundle and should not use this.
+  # swarm-ci-runner) needs no bundle and should not use this.
   #
   #   imports = [ (caTrust.trustBundle { inherit pkgs; name = "swarm-nats";
   #                                      consumers = [ "swarm-nats-auth" ]; }) ];