remove the hive-c0re forge-credential chain nothing reads any more

With no nix build on the hive, the boot publish of the forge token for nix has no reader. Removes the ForgeSweep node, the token file, the git credential helper and hive-c0re's forge gitconfig sections.

hive-c0re/src/job_queue/exec.rs

@@ -99,8 +99,6 @@ pub(super) trait Host: Sync {
     async fn delete_state_subvolume(&self, name: &str) -> Result<()>;
     /// The persistent directories a purge removes.
     fn purge_dirs(&self, name: &str) -> Vec<PathBuf>;
-    /// Publish the hive's forge credential for nix.
-    async fn forge_ensure_all(&self);
     /// One `/knowledge` pull.
     async fn knowledge_pull(&self, coord: &Arc<Coordinator>) -> Result<()>;
     /// One swarm wanted-state pull.
@@ -228,10 +226,6 @@ impl Host for RealHost {
             .collect()
     }
 
-    async fn forge_ensure_all(&self) {
-        crate::forge::ensure_all().await;
-    }
-
     async fn knowledge_pull(&self, coord: &Arc<Coordinator>) -> Result<()> {
         crate::workers::knowledge::pull(coord).await
     }
@@ -332,23 +326,12 @@ async fn dispatch(
         // `Finishing` so the nodes under it start. What they declare stays held
         // until their whole subtree settles.
         NodeKind::AgentWindow { .. } => Ok(()),
-        NodeKind::ForgeSweep => run_forge_sweep(host).await,
         NodeKind::KnowledgePull => run_knowledge_pull(host, coord, KNOWLEDGE_PULL_DEADLINE).await,
         NodeKind::WantedPull => run_wanted_pull(host, coord).await,
     };
     (builder, result)
 }
 
-/// Boot-time publish of the hive's forge credential for nix, as a DAG node —
-/// see [`NodeKind::ForgeSweep`]. `forge::ensure_all` logs its own outcome and
-/// is best-effort (a build re-publishes the credential before it fetches), so
-/// this wrapper has nothing left to report; it exists to make the step a
-/// visible unit of work.
-async fn run_forge_sweep(host: &impl Host) -> Result<()> {
-    host.forge_ensure_all().await;
-    Ok(())
-}
-
 /// `/knowledge` pull as a DAG node — see [`NodeKind::KnowledgePull`]. Every
 /// pass reports here, whoever submitted it: as the node's own error on the
 /// dashboard, and into the debounced warning.

hive-c0re/src/job_queue/exec/tests.rs

@@ -12,9 +12,9 @@ use hive_jobq::scheduler::Scheduler;
 
 use super::{
     Host, dispatch, run_create, run_destroy_bookkeeping, run_destroy_container, run_drain,
-    run_emit_rebuilt, run_forge_sweep, run_knowledge_pull, run_meta_sync, run_pause_drain,
-    run_pause_signal, run_prebuild, run_provision, run_purge_state, run_rebuild_bookkeeping,
-    run_reconcile, run_set_wanted, run_signal, run_start, run_stop, run_stop_for_update, run_swap,
+    run_emit_rebuilt, run_knowledge_pull, run_meta_sync, run_pause_drain, run_pause_signal,
+    run_prebuild, run_provision, run_purge_state, run_rebuild_bookkeeping, run_reconcile,
+    run_set_wanted, run_signal, run_start, run_stop, run_stop_for_update, run_swap,
     run_wanted_pull, run_write_dropin,
 };
 use crate::coordinator::{AgentPaths, Coordinator, HiveEnv};
@@ -254,10 +254,6 @@ impl Host for FakeHost {
         self.purge.clone()
     }
 
-    async fn forge_ensure_all(&self) {
-        self.record("forge_ensure_all".to_owned());
-    }
-
     async fn knowledge_pull(&self, _coord: &Arc<Coordinator>) -> anyhow::Result<()> {
         if self.hang {
             std::future::pending::<()>().await;
@@ -1131,13 +1127,6 @@ async fn emit_rebuilt_reports_success_and_failure_under_one_key() {
 
 // --- Sweeps and pulls ---------------------------------------------------------
 
-#[tokio::test]
-async fn forge_sweep_runs_once_and_never_fails() {
-    let host = FakeHost::up();
-    run_forge_sweep(&host).await.expect("ok");
-    assert_eq!(host.calls(), ["forge_ensure_all"]);
-}
-
 #[tokio::test]
 async fn knowledge_pull_passes_the_result_through_and_times_out() {
     let (_dir, coord) = coordinator();
@@ -1305,7 +1294,6 @@ async fn dispatch_routes_each_host_backed_kind_to_its_executor() {
 async fn dispatch_routes_the_agentless_and_hostless_kinds() {
     let host = FakeHost::up();
     for kind in [
-        NodeKind::ForgeSweep,
         NodeKind::WantedPull,
         NodeKind::KnowledgePull,
         alice(|agent| NodeKind::AgentWindow { agent }),
@@ -1325,7 +1313,7 @@ async fn dispatch_routes_the_agentless_and_hostless_kinds() {
         );
     }
     let calls = host.calls();
-    for want in ["forge_ensure_all", "wanted_pull", "knowledge_pull"] {
+    for want in ["wanted_pull", "knowledge_pull"] {
         assert!(calls.iter().any(|c| c == want), "{want} in {calls:?}");
     }
 }

hive-c0re/src/job_queue/model.rs

@@ -96,9 +96,6 @@ pub enum NodeKind {
     /// Write the agent's durable power intent (`wanted = Up` when `up`,
     /// else `Offline`) as the head node of a power-op DAG.
     SetWanted { agent: String, up: bool },
-    /// One-shot boot-time publish of the hive's forge read token for nix
-    /// (`forge::ensure_all`). Agentless.
-    ForgeSweep,
     /// `/knowledge` pull (`knowledge::pull`): at boot, on the swarm
     /// knowledge-changed event, and hourly. Agentless.
     KnowledgePull,
@@ -165,7 +162,7 @@ impl NodeKind {
             | NodeKind::AgentWindow { agent }
             | NodeKind::EmitRebuilt { agent, .. }
             | NodeKind::SetWanted { agent, .. } => agent,
-            NodeKind::ForgeSweep | NodeKind::KnowledgePull | NodeKind::WantedPull => "",
+            NodeKind::KnowledgePull | NodeKind::WantedPull => "",
         }
     }