swarm-ci-runner: run the forge CI runner as a swarm service

The CI runner was a hive deploy module: hive-ci.nix ran it beside the
forge, and hive-c0re registered it through the forge's admin API with
the `core` token, writing the registration token through hive-priv. It
could only run on the forge's host, and it kept an admin-scoped forge
token on a hive.

Now the runner is a swarm service:

- swarm-ci-runner.nix runs it in a `swarm-ci-runner` container on the
  host that sets deploy.ci-runner.enable, reaching the forge by name.
  It needs neither the forge nor a hive there.
- swarm-controller reads the forge's runner registration token with its
  own admin token and writes it to swarm/services/ci-runner/
  registration-token whenever it differs from what it last wrote. Its
  grant on that path is create/update only.
- The runner's own leaf (CN swarm-ci-runner, role and policy of the same
  name) reads that one path. swarm-bao-ci-runner.service fetches it into
  the runner's EnvironmentFile and restarts the runner on a change.
- A pre-start step removes .runner when the daemon's journal since its
  last start holds Forgejo's "unregistered runner" refusal (the daemon
  exits 1 when its startup Declare gets it), or when .runner names
  another forge address; upstream's pre-start step then registers again.

Removed from the hive side: hive-ci.nix and deploy.forgejo.ci.*,
forge/ci_runner.rs, PrivRequest::RegisterCiRunner and its handler and
ReadWritePaths entry, InfraContainer::Ci with hivectl's --ci and the
dashboard's hive-ci journal entry, HYPERHIVE_FORGE_CI_ENABLED, and
read:admin,write:admin from CORE_TOKEN_SCOPES: nothing else in hive-c0re
calls /api/v1/admin/*. The old ci options, under both swarm.forge.ci and
deploy.forgejo.ci, now fail evaluation naming deploy.ci-runner.

The forge's half of the old ci.enable, the actions/checkout mirror and
DEFAULT_ACTIONS_URL = self, is deploy.forgejo.actionsFromSelf.

Closes #4954

swarm-secret-client/src/ci.rs

@@ -0,0 +1,54 @@
+//! The CI runner agreement: where the forge's runner registration token lives,
+//! and what the object at that path holds.
+//!
+//! `swarm-controller` fetches the token with the forge's admin API and writes
+//! it here; `nix/host-modules/swarm-ci-runner.nix` reads it under the runner's
+//! own certificate. That runner's read stanza is the only one in the store that
+//! covers this path.
+
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    Error,
+    path::{Kind, principal_prefix},
+};
+
+/// The runner's name segment under [`Kind::Service`].
+const SERVICE: &str = "ci-runner";
+
+/// The path holding the forge's runner registration token.
+///
+/// # Errors
+/// Never in practice: the name segment is a constant. The `Result` is
+/// [`principal_prefix`]'s.
+pub fn registration_token_path() -> Result<String, Error> {
+    let prefix = principal_prefix(Kind::Service, SERVICE)?;
+    Ok(format!("{prefix}/registration-token"))
+}
+
+/// What the registration-token path holds.
+///
+/// No `Debug` derive: `value` registers a runner that receives jobs from every
+/// repo on the forge, and a derived `Debug` is one `{:?}` away from a log line.
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Credential {
+    /// The token itself. `swarm-ci-runner.nix` reads the store with
+    /// `bao kv get -field=value`, so this name is load-bearing for a reader
+    /// this crate does not control, the same as [`crate::matrix::Credential`]'s.
+    pub value: String,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_registration_token_is_under_the_runners_service_prefix() {
+        // The literal is what `swarm-bao.nix` grants the runner's role, and
+        // what the controller's write stanza names.
+        assert_eq!(
+            registration_token_path().expect("a constant segment is legal"),
+            "swarm/services/ci-runner/registration-token"
+        );
+    }
+}

swarm-secret-client/src/lib.rs

@@ -5,7 +5,7 @@
 //! the rules every path obeys ([`path`]), the translation from this
 //! deployment's environment into a logged-in client ([`client`]), and, per kind
 //! of secret, the path it lives at together with the fields it holds
-//! ([`matrix`], [`queue`], [`mtls`], [`forge`], [`github`], [`acp`]). Each of those is a thing the controller
+//! ([`matrix`], [`queue`], [`mtls`], [`forge`], [`github`], [`acp`], [`ci`]). Each of those is a thing the controller
 //! and a hive must say identically, so it is said once here.
 //!
 //! [`policy`] is the same kind of agreement seen from the other side: which of
@@ -23,6 +23,7 @@
 //! value inside it, and its doc explains why that is not circular.
 
 pub mod acp;
+pub mod ci;
 pub mod client;
 pub mod forge;
 pub mod github;

swarm-secret-client/src/path.rs

@@ -40,6 +40,9 @@ pub enum Kind {
     /// is what uses it.
     #[strum(serialize = "hives")]
     Hive,
+    /// One swarm service — the things a swarm runs beside the controller.
+    #[strum(serialize = "services")]
+    Service,
     /// The controller itself. There is one per swarm, so the name segment
     /// below it does not vary; the shape stays uniform anyway, because one
     /// grant pattern over `<kind>/<name>` is cheaper than a special case.
@@ -50,7 +53,7 @@ pub enum Kind {
 impl Kind {
     /// Every kind, so callers that must cover the whole set can iterate rather
     /// than restate it — a second list is a list that drifts.
-    pub const ALL: [Kind; 3] = [Kind::Agent, Kind::Hive, Kind::Controller];
+    pub const ALL: [Kind; 4] = [Kind::Agent, Kind::Hive, Kind::Service, Kind::Controller];
 
     /// What to call the name in an error — singular, because the message reads
     /// "hive name ... is not a single path segment".
@@ -59,6 +62,7 @@ impl Kind {
         match self {
             Kind::Agent => "agent",
             Kind::Hive => "hive",
+            Kind::Service => "service",
             Kind::Controller => "controller",
         }
     }
@@ -171,7 +175,7 @@ mod tests {
         // decision. Spelling each one out is what makes adding a kind a
         // deliberate edit.
         let segments: Vec<&str> = Kind::ALL.iter().map(|k| (*k).into()).collect();
-        assert_eq!(segments, ["agents", "hives", "controller"]);
+        assert_eq!(segments, ["agents", "hives", "services", "controller"]);
     }
 
     #[test]