swarm: let an agent publish its own icon

The auth callout grants an agent that presents its own queue credential
one more subject, `$KV.agent-icons.<agent>`: its own key in the
agent-icons bucket and no other. The hive's shared agent client is
granted none of the bucket, since every agent on a hive presents it.

hive-agent writes `/etc/hyperhive/icon.svg`, the file its `GET /icon`
serves, to that key once per start, as a JetStream publish straight to
the subject (what `kv::Store::put` sends, minus the bucket lookup), so
the one subject is the whole grant. No icon deletes the key. A failed
write, including one that arrives before the bucket exists, is retried
with backoff until acked. An agent connected with the hive's shared
client publishes nothing.

swarm-controller creates the bucket as soon as its queue connection is
up, instead of on the first icon read, so an agent's write does not
wait for someone to look.

Measured against a local nats-server with a user allowed publish on
`$KV.agent-icons.atlas` only: the write to its own key is stored and
readable, a write to `$KV.agent-icons.argus` is refused (the ack times
out), the DEL marker makes the key read as absent, and a write before
the bucket exists fails with "no responders".

swarm-nats-auth/src/agent_token.rs

@@ -232,6 +232,7 @@ mod tests {
         .with_agent_token_subjects(vec![
             "$SWARM.term.{agent}".to_owned(),
             "$SWARM.agent-state.{agent}".to_owned(),
+            "$KV.agent-icons.{agent}".to_owned(),
         ])
         .expect("valid")
     }
@@ -253,6 +254,7 @@ mod tests {
             vec![
                 "$SWARM.term.atlas".to_owned(),
                 "$SWARM.agent-state.atlas".to_owned(),
+                "$KV.agent-icons.atlas".to_owned(),
             ]
         );
     }

swarm-nats-auth/src/main.rs

@@ -359,12 +359,14 @@ mod tests {
             "$SWARM.term.{agent}",
             "--agent-token-publish-subject",
             "$SWARM.agent-state.{agent}",
+            "--agent-token-publish-subject",
+            "$KV.agent-icons.{agent}",
             "--store-cert-role",
             "swarm-nats-auth",
         ])
         .expect("the unit's own argument vector must parse");
         assert_eq!(args.agent_client_suffix, "-agent");
-        assert_eq!(args.agent_token_publish_subjects.len(), 2);
+        assert_eq!(args.agent_token_publish_subjects.len(), 3);
     }
 
     /// The control for the case above: an ordinary value parses through the

swarm-nats-auth/src/policy.rs

@@ -1232,6 +1232,34 @@ mod tests {
         );
     }
 
+    /// A verified agent may write its own icon key and no other agent's. The
+    /// hive's shared agent client, which every agent on the hive presents, may
+    /// write none of the bucket.
+    #[test]
+    fn an_agent_may_write_only_its_own_icon_key() {
+        use swarm_queue_client::agent_icon::{BUCKET, subject};
+
+        let p = policy_with_agent_subject()
+            .with_agent_token_subjects(vec!["$KV.agent-icons.{agent}".to_owned()])
+            .expect("a per-agent template is valid");
+        let atlas = p.agent_token_permissions("atlas").expect("configured");
+        assert_eq!(atlas.publish, vec![subject("atlas")]);
+        assert!(!atlas.publish.contains(&subject("argus")));
+        // Control: the same template does grant argus its own key, so atlas
+        // lacking it is atlas's grant being scoped.
+        let argus = p.agent_token_permissions("argus").expect("configured");
+        assert_eq!(argus.publish, vec![subject("argus")]);
+
+        let shared = p.permissions("hive-alpha-agent").expect("alpha's agents");
+        assert!(
+            !shared
+                .publish
+                .iter()
+                .any(|s| s.starts_with(&format!("$KV.{BUCKET}."))),
+            "the hive's shared agent client got an icon key: {shared:?}"
+        );
+    }
+
     #[test]
     fn an_agent_token_subject_without_the_placeholder_is_refused() {
         let err = policy()