nix: comments no longer say a hive's bao identity reads swarm/services/*

The hive's bao policy grants read on swarm/agents/* and swarm/hives/<hive>/* only. Five comments across four modules still listed swarm/services/* among its reads, or said a shared leaf would let a unit fetch another service's OIDC client secret, or that the hive's leaf reads every secret in the store. Comment and option-description text only.

nix/host-modules/glue-queue-agent-credential.nix

@@ -45,8 +45,8 @@ let
   # 🩸 This principal's OWN leaf, not `clientCertFile` — the hive's. Bao
   # matches a cert-auth role on the CN, so one leaf shared by four readers
   # would be ONE principal holding the union of four grants: read on
-  # `swarm/agents/*` AND `swarm/hives/<hive>/*` AND `swarm/services/*`, when
+  # `swarm/agents/*` AND `swarm/hives/<hive>/*`, when this unit reads one
-  # this unit reads one queue credential and nothing else. Its own leaf carries
+  # queue credential and nothing else. Its own leaf carries
   # `<queueAgentCommonNamePrefix>-<hive>` and its role grants the single path
   # below — still this hive's own, so the narrowing costs no reach.
   haveClientIdentity =

nix/host-modules/swarm-bao.nix

@@ -802,12 +802,13 @@ let
   # 🩸 Each of these reads exactly ONE path in the store, and does it holding
   # its own leaf rather than `deploy.bao.clientCertFile` — the hive's own leaf,
   # whose policy (`swarm-secret-client`'s `policy::render`) grants read on
-  # `swarm/agents/*`, `swarm/hives/<hive>/*` AND `swarm/services/*`.
+  # `swarm/agents/*` AND `swarm/hives/<hive>/*`, and nothing under
+  # `swarm/services/`.
   # Principals presenting one certificate are ONE principal to bao, so sharing
-  # the hive's leaf would leave only the union of what they need expressible:
+  # the hive's leaf would give each of them everything that leaf reads: the
-  # the unit that fetches Grafana's OIDC client secret could fetch every agent
+  # unit that fetches this hive's queue credential could fetch every agent
-  # credential in the swarm, and the unit that fetches this hive's queue
+  # credential in the swarm, and a unit that fetches a service's OIDC client
-  # credential could fetch Grafana's.
+  # secret could not fetch it at all, as that path is not the hive's to read.
   #
   # Each gets its own leaf, its own cert-auth role and a policy holding the
   # one `secret/data/…` path that principal's script actually names — spelled
@@ -1885,7 +1886,7 @@ in
         ⚠️ **Not** {option}`services.hyperhive.deploy.bao.clientCertFile`.
         Pointing this at the hive's own leaf would evaluate, deploy and log in —
         and hand a unit that reads one credential a certificate that reads every
-        secret in the store.
+        agent credential in the swarm and this hive's own secrets.
 
         No default here: ./glue-bao-tls.nix points it at the leaf it mints,
         wherever this host mints its own PKI. A deployment that reads a store on

nix/host-modules/swarm-grafana.nix

@@ -218,8 +218,8 @@ let
   # 🩸 Grafana's OWN leaf, not `clientCertFile` — the hive's. Bao matches a
   # cert-auth role on the CN, so one leaf shared by four readers would be ONE
   # principal holding the union of four grants: this unit could read every
-  # agent credential in the swarm and every other service's OIDC client
+  # agent credential in the swarm, when what it needs is the one path
-  # secret, when what it needs is the one path `storeSecretPath` names.
+  # `storeSecretPath` names.
   haveClientIdentity =
     baoDeploy.grafanaOidcClientCertFile != null && baoDeploy.grafanaOidcClientKeyFile != null;
 

nix/host-modules/swarm-otel.nix

@@ -253,8 +253,8 @@ let
   # 🩸 The collector's OWN leaf, not `clientCertFile` — the hive's. Bao
   # matches a cert-auth role on the CN, so one leaf shared by four readers
   # would be ONE principal holding the union of four grants: this unit could
-  # read every agent credential in the swarm and Grafana's OIDC client
+  # read every agent credential in the swarm, when what it needs is the one
-  # secret, when what it needs is the one path `storeSecretPath` names.
+  # path `storeSecretPath` names.
   haveClientIdentity =
     baoDeploy.otelOidcClientCertFile != null && baoDeploy.otelOidcClientKeyFile != null;