swarm-controller: keep a hive's read grant in step with its declaration

The controller writes an agent's credential; the hive fetches it back with
its own certificate. Nothing said which paths that certificate may read, so
the read half of a delivery answers 403 with no way to tell why.

The grant is derived from the declaration, so it is re-rendered at the one
place the declaration changes -- WantedWriter::set -- rather than at its
caller, which would work today and break on the second caller.

Emitted before the KV write: a grant that lands late is a 403 on an agent's
first fetch, while one that shrinks early only affects an agent already
being torn down. A failed write then leaves a superset the next declaration
re-renders.

Destroyed agents are filtered out. The declared set is a hive's whole
history -- a destroyed entry stays so that redeclaring it Up is refused as
the terminal transition it is -- so granting every declared agent would
leave a torn-down agent's credentials readable forever.

The sink is a trait because a missed emission is that same untraceable 403:
the double pins which agents were published, and the no-sink and refusing
arms pin the two deployments that are not a happy path. Not covered: the
call site inside set(), which needs a live queue.

The cert role moves to its own module on the way past. It is the
controller's identity at the store, not something the matrix route owns,
and the policy writer needs the same login.

swarm-controller/src/store.rs

@@ -0,0 +1,25 @@
+//! The controller's own identity at the swarm's secret store.
+//!
+//! Two paths log in: writing an agent's credential, and writing the read
+//! grant that lets a hive fetch one back. Both present the same certificate
+//! under the same role, so the role is named here rather than at each caller.
+
+use swarm_secret_client::{Error, SecretStore};
+
+/// The cert-auth role the controller logs in under.
+///
+/// `nix/host-modules/swarm-bao.nix`'s `controllerPolicyName` creates the role,
+/// names the policy after it, and `nix/module-eval.nix` pins the literal.
+///
+/// ⚠️ Not the certificate's CN. The role *matches on* the CN
+/// (`allowed_common_names`), so the two are deliberately different strings.
+pub const CERT_ROLE: &str = "swarm-controller";
+
+/// Log in to the store with this deployment's certificate.
+///
+/// # Errors
+/// Whatever [`SecretStore::from_env`] raises — an unset `BAO_*` variable, an
+/// unreadable identity file, or a store that refuses the login.
+pub async fn connect() -> Result<SecretStore, Error> {
+    SecretStore::from_env(CERT_ROLE).await
+}