swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

nix/module-eval/forge-placement.nix

@@ -46,11 +46,21 @@ let
     deploy.forgejo.sso.clientSecretFile = "/var/lib/forgejo-oidc/by-hand.secret";
   };
 
-  ciNoForge = hive { deploy.forgejo.ci.enable = true; };
-  ciWithForge = hive {
-    deploy.forgejo.enable = true;
-    deploy.forgejo.ci.enable = true;
+  # The runner alone: no hive, no forge, no store, its store identity placed
+  # by hand.
+  ciAlone = hive {
+    deploy.hive-controller.enable = false;
+    deploy.ci-runner.enable = true;
+    deploy.bao.ciRunnerClientCertFile = "/etc/pki/bao-ci-runner.pem";
+    deploy.bao.ciRunnerClientKeyFile = "/etc/pki/bao-ci-runner-key.pem";
   };
+  ciNoIdentity = hive {
+    deploy.hive-controller.enable = false;
+    deploy.ci-runner.enable = true;
+  };
+
+  # A host config that still names the runner under the forge.
+  ciUnderForge = hive { deploy.forgejo.ci.enable = true; };
 
   runsForge = m: m.services.hyperhive.deploy.forgejo.enable && m.containers ? hive-forge;
 
@@ -122,13 +132,28 @@ let
         == "https://forge.t.local/user/oauth2/authelia/callback";
     }
     {
-      # The runner reaches the forge through this host's gateway and is
-      # registered through the local container. The second arm is the
-      # control: a refusal that fires everywhere is not a check.
-      name = "CI is refused on a host that does not run the forge";
+      # The runner reaches the forge by name and reads its token with its own
+      # certificate, so nothing about the host it runs on is asked.
+      name = "the CI runner runs on a host with neither the forge nor a hive";
       ok =
-        refusedOver ciNoForge "deploy.forgejo.enable on the same host"
-        && !(refusedOver ciWithForge "deploy.forgejo.enable on the same host");
+        ciAlone.containers ? swarm-ci-runner
+        && !(ciAlone.containers ? hive-forge)
+        && !ciAlone.services.hyperhive.deploy.hive-controller.enable
+        && !(refusedOver ciAlone "ci-runner")
+        &&
+          ciAlone.systemd.services.swarm-bao-ci-runner.environment.BAO_CLIENT_CERT
+          == "/etc/pki/bao-ci-runner.pem";
+    }
+    {
+      # Without the identity the token never arrives; the control is the
+      # placed pair above.
+      name = "the CI runner is refused without its store identity";
+      ok = refusedOver ciNoIdentity "deploy.bao.ciRunnerClientCertFile";
+    }
+    {
+      # A removed option evaluates to an assertion naming the replacement.
+      name = "a CI option under deploy.forgejo names its replacement under deploy.ci-runner";
+      ok = refusedOver ciUnderForge "services.hyperhive.deploy.ci-runner.enable instead";
     }
     {
       # Nothing writes the delivery path away from the forge, and a