grant manage_root_agent by stored permission only, not by the name ruth

Permission::default_for and hive-sh4re's MANAGER_AGENT are gone: every
agent with no permissions key holds Permission::DEFAULT, ruth included.
The agent-name parameters that only fed default_for go with it
(permissions::effective, HiveCopy::before_read/after_read and their
callers).

swarm-controller seeds the grant ruth held by name: at start, a declared
ruth whose permissions are unset gets DEFAULT plus manage_root_agent
written into her key, once, logged. A set key is never touched. It is a
one-shot to delete once every swarm has passed it.

The swarm UI setup assistant opens the create form with
manage_root_agent checked, so a new ruth is created with the grant.
permissions_import no longer adds ruth to the import or splits her
default. Docs and help text no longer say ruth holds the grant by
default; swarmctl-cli.md regenerated.

hive-c0re/src/workers/permissions_import.rs

@@ -54,27 +54,17 @@ fn parse(agent: &str, name: &str) -> Option<Permission> {
 ///   only unknown names, was the default groups. `lifecycle`/`forge` count as
 ///   known (they parsed) and are then dropped, so an entry of only those
 ///   held no tools and imports as none.
-/// - capabilities: the entry's names. With the file present, `ruth` having no
-///   entry means her grant was revoked: the file was created holding it, and
-///   a revoke removed the entry. With no file, the default.
+/// - capabilities: the entry's names; no entry, or no file, is none.
 ///
-/// An agent whose list equals [`Permission::default_for`] is left out, so its
-/// key stays unset and follows the default.
+/// An agent whose list equals [`Permission::DEFAULT`] is left out, so its key
+/// stays unset and follows the default.
 fn grants(caps: Option<&FileMap>, groups: Option<&FileMap>) -> Grants {
     let mut agents: BTreeSet<&str> = BTreeSet::new();
     agents.extend(caps.iter().flat_map(|m| m.keys().map(String::as_str)));
     agents.extend(groups.iter().flat_map(|m| m.keys().map(String::as_str)));
-    if caps.is_some() {
-        agents.insert(crate::lifecycle::MANAGER_NAME);
-    }
+    let default = Permission::DEFAULT;
     let mut out = Grants::new();
     for agent in agents {
-        let default = Permission::default_for(agent);
-        let tool_default: Vec<Permission> = default
-            .iter()
-            .copied()
-            .filter(|p| *p != Permission::ManageRootAgent)
-            .collect();
         let tool_part = match groups.and_then(|m| m.get(agent)) {
             Some(names)
                 if names.iter().any(|n| {
@@ -84,19 +74,12 @@ fn grants(caps: Option<&FileMap>, groups: Option<&FileMap>) -> Grants {
             {
                 names.iter().filter_map(|n| parse(agent, n)).collect()
             }
-            _ => tool_default,
-        };
-        let cap_part: Vec<Permission> = match caps {
-            Some(m) => m
-                .get(agent)
-                .map(|names| names.iter().filter_map(|n| parse(agent, n)).collect())
-                .unwrap_or_default(),
-            None => default
-                .iter()
-                .copied()
-                .filter(|p| *p == Permission::ManageRootAgent)
-                .collect(),
+            _ => default.to_vec(),
         };
+        let cap_part: Vec<Permission> = caps
+            .and_then(|m| m.get(agent))
+            .map(|names| names.iter().filter_map(|n| parse(agent, n)).collect())
+            .unwrap_or_default();
         let mut list: Vec<Permission> = Vec::new();
         for perm in tool_part.into_iter().chain(cap_part) {
             if !list.contains(&perm) {
@@ -275,24 +258,15 @@ mod tests {
                 "sock": ["lifecycle"]}"#,
         );
         let out = grants(Some(&caps), Some(&groups));
-        assert!(!out.contains_key("ruth"), "ruth's seed is her default");
+        assert_eq!(
+            out["ruth"],
+            vec![Messaging, Meta, Inbox, Execution, ManageRootAgent]
+        );
         assert_eq!(out["atlas"], vec![Messaging, WebTools, ManageRootAgent]);
         assert_eq!(out["iris"], vec![Messaging]);
         assert_eq!(out["sock"], Vec::<Permission>::new());
     }
 
-    /// Without a capabilities entry, ruth's existing file means a revoke; with
-    /// no capabilities file at all, her default stands.
-    #[test]
-    fn a_revoked_ruth_stays_revoked() {
-        let out = grants(Some(&file("{}")), None);
-        assert_eq!(out["ruth"], vec![Messaging, Meta, Inbox, Execution]);
-
-        let out = grants(None, Some(&file(r#"{"atlas": ["messaging"]}"#)));
-        assert!(!out.contains_key("ruth"));
-        assert_eq!(out["atlas"], vec![Messaging]);
-    }
-
     /// The seed writes once, from the files, and never over a stored read.
     #[test]
     fn the_seed_copies_the_files_only_when_nothing_is_stored() {