swarm-controller: keep a hive's read grant in step with its declaration

The controller writes an agent's credential; the hive fetches it back with
its own certificate. Nothing said which paths that certificate may read, so
the read half of a delivery answers 403 with no way to tell why.

The grant is derived from the declaration, so it is re-rendered at the one
place the declaration changes -- WantedWriter::set -- rather than at its
caller, which would work today and break on the second caller.

Emitted before the KV write: a grant that lands late is a 403 on an agent's
first fetch, while one that shrinks early only affects an agent already
being torn down. A failed write then leaves a superset the next declaration
re-renders.

Destroyed agents are filtered out. The declared set is a hive's whole
history -- a destroyed entry stays so that redeclaring it Up is refused as
the terminal transition it is -- so granting every declared agent would
leave a torn-down agent's credentials readable forever.

The sink is a trait because a missed emission is that same untraceable 403:
the double pins which agents were published, and the no-sink and refusing
arms pin the two deployments that are not a happy path. Not covered: the
call site inside set(), which needs a live queue.

The cert role moves to its own module on the way past. It is the
controller's identity at the store, not something the matrix route owns,
and the policy writer needs the same login.

swarm-controller/src/main.rs

@@ -47,7 +47,9 @@ mod forge;
 mod issue_report;
 mod matrix_account;
 mod otel_http_client;
+mod read_policy;
 mod status;
+mod store;
 mod vcs_metrics;
 mod wanted;
 mod webhook;
@@ -729,7 +731,32 @@ fn render(declaration: &swarm_queue_client::wanted::HiveWanted) -> Vec<AgentDecl
 /// auth-callout traffic and give the two paths independent reconnect state,
 /// so one could be serving while the other was still down.
 fn wanted_writer(status: Option<&Arc<status::StatusReader>>) -> Option<Arc<wanted::WantedWriter>> {
-    status.map(|s| Arc::new(wanted::WantedWriter::new(s.queue_client())))
+    status.map(|s| {
+        Arc::new(wanted::WantedWriter::new(
+            s.queue_client(),
+            read_policy_sink(),
+        ))
+    })
+}
+
+/// The sink that keeps a hive's read grant in step with its declaration, or
+/// `None` on a deployment that has no store identity to write one with.
+///
+/// Decided once here rather than per write: the `BAO_*` environment is a
+/// systemd unit's, so a variable that is absent at start is absent for the
+/// life of the process. The absent case is logged because it is otherwise
+/// indistinguishable from a grant that is being published and ignored.
+fn read_policy_sink() -> Option<Arc<dyn read_policy::ReadPolicySink>> {
+    match swarm_secret_client::client::Settings::from_env() {
+        Ok(_) => Some(Arc::new(read_policy::StoreSink)),
+        Err(e) => {
+            tracing::info!(
+                reason = %e,
+                "no secret-store identity: hives get no read grant, and no credential delivery either"
+            );
+            None
+        }
+    }
 }
 
 /// The per-agent status reader, sharing the status reader's connection and