hive-runtime: respawn the ACP agent when its provider key changed after a failed turn

The provider key was resolved once, at spawn. A provider rejecting it
shows only as an empty end_turn or an idle timeout, neither of which
drops the agent, so a key rotated in the store never reached a running
opencode until the process died for another reason.

After a turn fails with EmptyEndTurn or IdleTimeout, the runtime now
resolves the key once more. When that yields a key that differs from
the one the agent was spawned with, the agent is dropped (SIGINT to its
process group, as every other respawn) and the next turn spawns it with
the new key and reloads the recorded session. No key read (inherited
env value, no store, a failed or timed-out read, nothing stored) keeps
the running agent. The failed turn's error is returned unchanged.

Part of #5017 (slice A).

nix/agent-modules/agent-service.nix

@@ -206,6 +206,8 @@ in
       On an ACP agent using the `opencode` preset, a provider key this file
       leaves unset is read from the swarm secret store at
       `swarm/agents/<agent>/acp-provider`, field `api_key`, if one is stored.
+      After a turn that ends empty or idle, the store is read again, and a
+      key that changed there gets the agent respawned with it.
     '';
   };