swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

nix/module-eval/swarm-services-switch.nix

@@ -116,6 +116,12 @@ let
     deploy.forgejo.enable = true;
     deploy.forgejo.mirrors = [ aMirror ];
   };
+  controllerWithSelfActions = hive {
+    deploy.swarm-controller.enable = true;
+    deploy.forgejo.enable = true;
+    deploy.forgejo.mirrors = [ aMirror ];
+    deploy.forgejo.actionsFromSelf = true;
+  };
 
   # The controller with every shared service on another host, and the same
   # controller hosting them all: the swarm UI's links must not tell the two
@@ -150,7 +156,7 @@ let
   serviceContainersWithCi = hive {
     deploy.hive-controller.enable = false;
     deploy.allSwarmServices = true;
-    deploy.forgejo.ci.enable = true;
+    deploy.ci-runner.enable = true;
   };
   serviceContainers = serviceContainersWithCi.containers;
   cases = [
@@ -412,7 +418,7 @@ let
       name = "a service container on a netns of its own keeps its firewall and resolvconf";
       ok =
         let
-          c = serviceContainers.hive-ci.config;
+          c = serviceContainers.swarm-ci-runner.config;
         in
         c.networking.firewall.enable && c.networking.resolvconf.enable;
     }
@@ -446,6 +452,22 @@ let
         in
         warns mirrorsNoController && !(warns controllerWithMirrors);
     }
+    {
+      # The mirror is what `self` resolves `actions/checkout` to, so the two
+      # come together. The control is the same forge without the option.
+      name = "actionsFromSelf adds the checkout mirror and resolves actions from the forge";
+      ok =
+        let
+          mirrorsOf =
+            m: builtins.fromJSON m.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_FORGE_MIRRORS;
+          actionsUrlOf =
+            m: m.containers.hive-forge.config.services.forgejo.settings.actions.DEFAULT_ACTIONS_URL or null;
+        in
+        lib.elem "actions/checkout" (map (m: m.dest) (mirrorsOf controllerWithSelfActions))
+        && actionsUrlOf controllerWithSelfActions == "self"
+        && mirrorsOf controllerWithMirrors == [ aMirror ]
+        && actionsUrlOf controllerWithMirrors == null;
+    }
     {
       name = "the old c0re org-avatar option lands on the controller's unit";
       ok =