swarm-controller: own the swarm-wide forge objects; hive-c0re stops creating them

The orgs agent-configs/internal/agents (plus mirror owners), the
operators team in agents and agent-configs, the pull-mirrors,
internal/docs, internal/knowledge (public, README-seeded) and the
agent-configs org avatar are one set per forge. hive-c0re ensured them in
its boot sweep, as the core admin, and only on the hive co-located with
the forge container.

swarm-controller now reconciles them at start and every 5 minutes
(forge/objects.rs: observe -> pure plan -> apply). A failed object logs
a warn line plus a pass summary and is retried next tick. create_repo
ensures the agent-configs org and its operators team first, so a config
repo's merge gate never depends on the periodic pass having run.

hive-c0re drops ensure_org, SEEDED_ORGS, ensure_mirrors/ensure_mirror_repo,
ensure_operators_team, ensure_shared_docs_repo, ensure_knowledge_repo/
set_repo_public, seed_readme, ensure_config_org_avatar and the one-shot
knowledge::remove_webhook cleanup, with their now-unused helpers.

nix: the mirror list moves from the hive-c0re unit
(HYPERHIVE_FORGE_MIRRORS) to the swarm-controller unit
(SWARM_CONTROLLER_FORGE_MIRRORS), with an eval warning when mirrors are
declared on a host that runs no controller. c0re.orgAvatarPng is renamed
to deploy.swarm-controller.configOrgAvatarPng.

Refs #3782

nix/host-modules/hive-c0re/environment.nix

@@ -47,15 +47,6 @@ in
   # prompts). `hive_sh4re::assets::*` reads paths underneath.
   # `forge/users.rs` reads the core avatar PNG from here on startup.
   HIVE_ASSETS_DIR = "${cfg.assets}/share/hyperhive";
-  # `agent-configs` org avatar PNG — independently overridable via
-  # `orgAvatarPng` without replacing the whole `assets` package.
-  # Falls back to the bundled PNG under HIVE_ASSETS_DIR when unset.
-  # Read by `forge::users::config_org_avatar_png_path`.
-  HIVE_ORG_AVATAR_PNG =
-    if cfg.orgAvatarPng != null then
-      "${cfg.orgAvatarPng}"
-    else
-      "${cfg.assets}/share/hyperhive/branding/agent-configs.png";
   # Whether this hive runs ruthless — no root/manager agent at all
   # (`auto_update::ensure_root_agent`). Default false = root
   # auto-managed; true makes the sweep a no-op.