swarm-bao: give each hive-cert consumer its own bao identity

Four units read one path each out of the store, and all four logged in
holding `deploy.bao.clientCertFile` — the hive's own leaf. Bao identifies
a principal by the subject of the certificate it presents, so four
readers behind one certificate were ONE principal, and the only grant
expressible was the union of what the four need: read on
`swarm/agents/*`, `swarm/hives/<hive>/*` and `swarm/services/*`. The unit
fetching Grafana's OIDC client secret could fetch every agent credential
in the swarm; the one fetching this hive's matrix token could fetch
Grafana's. Least privilege was not misconfigured here, it was
unrepresentable.

Each now holds a leaf, a cert-auth role and a policy of its own, and each
policy is the single `secret/data/…` path that unit's own script names —
spelled to the leaf, not to a prefix, the way matrix-ctl's already is.
Following the four exemplars in-tree rather than building a mechanism:
`signLeaf` mints the leaves, `swarm-bao.nix` writes the roles from the
bootstrap token, the consumers name their own pair.

Two of the four are written PER HIVE and two are not, which is the shape
of the paths rather than a preference. A matrix appservice token and a
queue credential live under `swarm/hives/<name>/` and every hive runs a
reader for its own, so one role for all of them would have to be granted
`hives/*` — letting one hive read another's, a reach no hive has today.
An OIDC client secret lives under `swarm/services/<client-id>/` and a
swarm registers each exactly once, so one role each is enough. The
per-hive subjects are `<prefix>-<hive>` and swarm.nix reserves every
composed spelling as a hive name, so a hive cannot be named into another
hive's role.

The shared leaf stays: hive-c0re still passes it into its container, the
`bao` CLI wrapper still defaults to it, and the three
`glue-*-bao-identity.nix` files derive the PKI directory from it.

module-eval-bao-grants gains a negative arm per principal — each pins the
three stanzas the hive's leaf carried and the two wildcards a later
widening would reach for, so a policy that grows fails here rather than
in a store. Plus the consuming side: repointing a unit back at the hive's
leaf would evaluate, deploy and log in, and silently restore the union.

A hive that reads a store on another machine now places one leaf per
principal instead of one shared by four. That cost is the point, and
docs/swarm/secrets.md lists the pairs.

nix/module-eval/name-guards.nix

@@ -63,6 +63,35 @@ let
     swarm.hives.mintctl.domain = "m.t.local";
   };
 
+  # The two OIDC-secret readers' subjects, fixed strings like the three above.
+  hiveNamedAfterGrafanaOidcSubject = hive {
+    deploy.swarm-otel.enable = false;
+    deploy.bao.grafanaOidcCommonName = "gfctl";
+    swarm.hives.gfctl.domain = "g.t.local";
+  };
+
+  hiveNamedAfterOtelOidcSubject = hive {
+    deploy.swarm-otel.enable = false;
+    deploy.bao.otelOidcCommonName = "otctl";
+    swarm.hives.otctl.domain = "o.t.local";
+  };
+
+  # 🩸 A different shape from every fixture above: the matrix-token and
+  # queue-credential roles are written PER HIVE, so the subject a hive must not
+  # be is `<prefix>-<some hive's name>` rather than the prefix itself. Reserving
+  # only the prefix would leave the composed spelling free, and a hive taking it
+  # would present a leaf the other hive's role accepts — which is a hive reading
+  # another hive's queue credential, the exact widening the split exists to
+  # avoid.
+  #
+  # Two hives here, not one: the collision is with the OTHER hive's role.
+  hiveNamedAfterPerHiveReaderSubject = hive {
+    deploy.swarm-otel.enable = false;
+    deploy.bao.queueAgentCommonNamePrefix = "qr";
+    swarm.hives.other.domain = "o.t.local";
+    swarm.hives.qr-other.domain = "q.t.local";
+  };
+
   hiveNameWithComposedWord = hive {
     deploy.swarm-otel.enable = false;
     swarm.hives."h1-agent".domain = "a.t.local";
@@ -111,6 +140,36 @@ let
           a: !a.assertion && lib.hasInfix "'mintctl'" a.message
         ) hiveNamedAfterMatrixCtlSubject.assertions;
     }
+    {
+      # The fourth and fifth, for the reason the case above gives: `certAuthCns`
+      # is where a role added beside the others registers itself, and nothing
+      # but a case per element notices when one forgets. These two are the
+      # subjects of the readers that fetch Grafana's and the collector's OIDC
+      # client secrets.
+      name = "a hive named after either OIDC-secret reader's subject is refused too";
+      ok =
+        equalityGuardFired hiveNamedAfterGrafanaOidcSubject
+        && lib.any (
+          a: !a.assertion && lib.hasInfix "'gfctl'" a.message
+        ) hiveNamedAfterGrafanaOidcSubject.assertions
+        && equalityGuardFired hiveNamedAfterOtelOidcSubject
+        && lib.any (
+          a: !a.assertion && lib.hasInfix "'otctl'" a.message
+        ) hiveNamedAfterOtelOidcSubject.assertions;
+    }
+    {
+      # 🩸 The per-hive half, and the one a prefix-only reservation would miss:
+      # the role is `<prefix>-<hive>`, so the reserved string has to be composed
+      # against every declared hive. Here hive `qr-other` collides with the role
+      # written for hive `other` — a leaf that reads a credential belonging to a
+      # hive that is not it.
+      name = "a hive named after another hive's per-hive reader subject is refused";
+      ok =
+        equalityGuardFired hiveNamedAfterPerHiveReaderSubject
+        && lib.any (
+          a: !a.assertion && lib.hasInfix "'qr-other'" a.message
+        ) hiveNamedAfterPerHiveReaderSubject.assertions;
+    }
     {
       # Without this the case above proves nothing: an arm that fires for every
       # roster is not a guard, and `hives` is non-empty in both fixtures.