config repos: drop the hive's branch-protection edit and core from the merge gate

Folds in #4853: hive-c0re no longer writes branch protection on
`agent-configs` repos (apply_config_repo_branch_protection,
config_repo_protection_edit, record_branch_protection_result and the
now-unused main_branch_protection_option go). swarm-controller's
CreateRepo rule and its forge-objects convergence own `main`'s gate.

Nothing merges into config `main` as `core` any more, so the converged
rule's merge user list is empty. `push_config` still pushes `main` as
core, through push rights, not the merge whitelist.

Refs #4850
Refs #4853

hive-c0re/src/forge/reconcile.rs

@@ -8,8 +8,8 @@
 //! the divergence). `Apply(Forge)` resets the local applied checkout to
 //! forge `main` — the change takes effect on the next deploy (the deploy's
 //! `--override-input` re-locks against the reset local tree); it does NOT
-//! auto-deploy. `Apply(Local)` is not supported: forge `main` is core-only
-//! branch-protected (advanced solely by the config-PR ff-merge API).
+//! auto-deploy. `Apply(Local)` is not supported: forge `main` is
+//! branch-protected, so it only advances through a config-PR merge.
 
 use std::path::{Path, PathBuf};
 
@@ -141,8 +141,8 @@ pub async fn reconcile_config_apply(
 ) -> Result<HostResponse> {
     match direction {
         ReconcileDirection::Local => Ok(HostResponse::error(
-            "reconciling forge from local is not supported yet: forge main is core-only \
-             branch-protected (no-push, ff-merge-API-only). Resolve via a config PR, or use \
+            "reconciling forge from local is not supported yet: forge main is \
+             branch-protected. Resolve via a config PR, or use \
              `--from forge` to reset the local checkout to forge main.",
         )),
         ReconcileDirection::Forge => {