hive-tls: keep ca-key.pem on disk, and re-issue a leaf that does not match its key

hive-tls-ca no longer deletes a ca-key.pem an earlier generation left:
nothing reads it, and leaving it means a rollback finds the old key instead
of minting a new anchor. Deleting it moves to PR 3, beside dropping ca.pem
from the trust bundle.

hive-tls-resign now also re-issues when the leaf's public key differs from
the key file's. The leaf and key are moved into place by two renames, and an
interrupted pair left a certificate beside the wrong key that the validity
check accepted.

Refs #4588

docs/networking/gateway.md

@@ -86,7 +86,7 @@ The issuer is the **secret store's `pki` mount**, not a bare self-signed leaf. `
 
 **Cert shape**: the leaf's CN is the bare hive domain; its SANs are `<hive>` and `*.<hive>`. The hive's role allows nothing outside `<hive>`, so a swarm-service name can't go on this leaf. Those names get the swarm-services leaf instead ([`swarm/ca.md`](../swarm/ca.md)).
 
-**Rotation**: `hive-tls-resign.service` runs at boot, on every deploy and once a day, and asks the store for a new leaf when the current one is missing, past half its 720-hour lifetime, no longer covers the configured names, or doesn't chain to the store's root. A leaf already on disk lets the gateway start while the store can't answer; a failed renewal leaves it in place. To force a rotation, delete `gateway.pem` under the state dir and restart the unit; it re-imports the leaf and reloads `nginx` itself.
+**Rotation**: `hive-tls-resign.service` runs at boot, on every deploy and once a day, and asks the store for a new leaf when the current one is missing, past half its 720-hour lifetime, no longer covers the configured names, doesn't match its key, or doesn't chain to the store's root. A leaf already on disk lets the gateway start while the store can't answer; a failed renewal leaves it in place. To force a rotation, delete `gateway.pem` under the state dir and restart the unit; it re-imports the leaf and reloads `nginx` itself.
 
 **Cert prompts**: browsers warn once per host until you add the hive's `trust-bundle.pem` (the anchor, not the leaf) to the browser or OS trust store. A container that needs to trust it for its own outbound TLS gets the bundle a different way, bind-mounted read-only at `/run/hive-ca/trust-bundle.pem` (`nix/host-modules/lib/hive-ca-trust.nix`).
 

docs/swarm/ca.md

@@ -48,9 +48,9 @@ identity a swarm service uses.
 **When it issues.** The unit runs at boot, on every deploy, and from
 `hive-tls-resign.timer` once a day. It asks the store for a new leaf when
 the current one is missing, past half the role's 720-hour lifetime, missing
-a configured name, or doesn't chain to the store's root
-(`swarm-services-root.pem`). That last check is what replaces a leaf the
-retired hive CA signed, on the first run that reaches the store.
+a configured name, doesn't match the key beside it, or doesn't chain to the
+store's root (`swarm-services-root.pem`). That last check is what replaces a
+leaf the retired hive CA signed, on the first run that reaches the store.
 
 **The gateway doesn't wait for the store.** Nothing orders the gateway after
 `hive-tls-resign.service`, so a hive holding a valid leaf starts its gateway
@@ -76,9 +76,10 @@ the file every consumer anchors on. It holds whichever of these exist:
 - the swarm root, `<swarm.ca.stateDir>/root.pem`, on the host that generates
   it.
 
-No hive keeps a CA key. `hive-tls-ca.service` deletes
-`<deploy.hive-controller.tls.stateDir>/ca-key.pem` where an earlier
-generation left one, and generates no CA.
+No hive generates a CA or signs with a CA key. A
+`<deploy.hive-controller.tls.stateDir>/ca-key.pem` an earlier generation left
+stays on disk, unread: removing it comes with dropping `ca.pem` from the
+bundle.
 
 ⚠️ **A consumer reads its trust when it starts.** An agent or service
 container that last started before the store's root reached the bundle