mint per-agent proxy credentials and a per-hive squid self-check credential

nix/host-modules/swarm-bao.nix

@@ -486,6 +486,10 @@ let
       capabilities = ["create", "read", "update"]
     }
 
+    path "${credentialMountPath}/data/swarm/hives/+/squid-selfcheck" {
+      capabilities = ["create", "read"]
+    }
+
     ${lib.concatMapStrings readStanza (
       map (leaf: "${credentialMountPath}/data/${leaf}") atticFactLeaves
     )}