mount the applied config repo, not the proposed one

/agents/<name>/config bound the working clone a config change is staged
in, so an agent could see a proposal that was never approved -- a config
that does not govern its container. Both objects already exist; this
repoints the bind at the deployed one.

Both mounts (own + child) now resolve through config_bind_source() so
they cannot drift, and agent_proposed_dir's doc-comment is corrected:
it claimed to be manager-editable and bind-mounted, and neither is true.

hive-c0re/src/coordinator.rs

@@ -1567,8 +1567,13 @@ impl Coordinator {
         crate::paths::agent_runtime_dir(name).join("mcp.sock")
     }
 
-    /// Manager-editable proposed config repo. Bind-mounted into the manager
-    /// container as `/agents/<name>/config/`.
+    /// The *proposed* config repo: where a config change lands before it is
+    /// applied, and what an approved deploy promotes into `applied_dir`.
+    ///
+    /// **Not bind-mounted into any container.** An agent that edits a config
+    /// clones it from the forge itself; `/agents/<name>/config` shows the
+    /// applied (deployed) tree instead — see `config_bind_source` in
+    /// `lifecycle/host_config.rs`.
     pub fn agent_proposed_dir(name: &hive_types::Ident) -> PathBuf {
         crate::paths::agent_state_dir(name).join("config")
     }