build agents only from internal/meta; delete the hive's local meta flake

The hive no longer renders, locks or commits a meta flake. A rebuild's
MetaSync node picks the internal/meta commit and records it with the
hyperhive and config pins it holds; Prebuild, Swap and Create build from it,
and a head that does not pin the agent's current config fails the build
naming the agent. hive-priv's meta_rev is required.

Removed: meta.rs sync/lock/render, the manual-rebuild relock, the boot
sweep's hyperhive bump (MetaLock), the update-meta-inputs form and its
panel, MetaWindow, the hive's hyperhive_rev setting.

Kept: agent_set::refresh holds what sync_agents also did (topology.json, the
gateway's agent-socket map and nginx include), called from spawn, destroy,
rebuild and the migration.

The boot reconcile and the stale-start upgrade compare the agent's marker
with the hyperhive pin of internal/meta; the dashboard's deployed chip reads
the config marker a successful build writes.

hive-c0re/src/lifecycle/setup.rs

@@ -260,8 +260,8 @@ fn initial_agent_nix(name: &str) -> String {
 }
 
 /// Module-only flake exposed by every agent's repo. Consumed by the
-/// hive-c0re-owned meta flake at `/var/lib/hyperhive/meta/` as a flake
-/// input. The wrapper is intentionally permissive:
+/// swarm's `internal/meta` flake as a flake input. The wrapper is
+/// intentionally permissive:
 ///
 /// - Manager edits `inputs.* = …` to add other flakes (e.g. an MCP
 ///   server's own flake) — the lock for those lands in the agent's