move client-cert gauges behind an otel feature of swarm-secret-client, drop the crate

swarm-controller/Cargo.toml

@@ -94,8 +94,6 @@ serde_json.workspace = true
 serde_norway = "0.9.42"
 strum.workspace = true
 swarm-authelia-bridge-sock.workspace = true
-# The `bao.client_cert.*` gauges on this exporter.
-swarm-cert-metrics.workspace = true
 # `schema`: the forge and schedule routes describe these bodies in the spec.
 swarm-controller-api = { workspace = true, features = ["schema"] }
 # The queue connect (token mint + auth callback + reconnect) is shared with
@@ -124,7 +122,7 @@ swarm-queue-client = { workspace = true, features = [
 # crate the hive reads it back with, which is the point: the path, the field
 # name and the object's shape are agreements between the two ends, and a
 # second spelling here would be a store this hive could not read.
-swarm-secret-client.workspace = true
+swarm-secret-client = { workspace = true, features = ["otel"] }
 # The builder, claude login and review classifier subjects, requests and
 # replies it sends. `schema`: the review classifier try-out API serves the
 # same shapes, so they derive `ToSchema`.

swarm-controller/src/main.rs

@@ -250,7 +250,10 @@ async fn main() -> Result<()> {
 fn register_cert_gauges(provider: Option<&opentelemetry_sdk::metrics::SdkMeterProvider>) {
     use opentelemetry::metrics::MeterProvider as _;
     if let Some(provider) = provider {
-        swarm_cert_metrics::register(&provider.meter("hyperhive.bao_client_cert"), "controller");
+        swarm_secret_client::cert_metrics::register(
+            &provider.meter("hyperhive.bao_client_cert"),
+            "controller",
+        );
     }
 }