feat(#1867): make the internal forge mandatory (remove forge.enable)

The internal forge is the canonical store for the meta flake, every
agent's config repo, and the internal/* repos, so it can no longer be
optional. Remove the services.hyperhive.forge.enable toggle:

- hive-forge.nix: drop the `enable` option; the forge config now
  deploys gated on `services.hyperhive.enable` (it ships with hyperhive).
- hive-c0re.nix: HIVE_FORGE_URL env unconditional; forge-public-URL gate
  drops the enable check (keeps behindGateway).
- hive-gateway.nix: local /etc/hosts forge entry keyed on behindGateway.
- hive-ci.nix: drop the now-moot `forge.ci.enable requires forge.enable`
  assertion (forge is always present); reword the option doc.
- nix/docs/default.nix: drop the `forge.enable = mkForce false` stub
  (option gone); the options-doc eval stays light via hyperhive.enable.
- hive-c0re forge.rs / hivectl.rs: reword 'forge.enable = true' error
  text to 'wait for hive-c0re to start the container' (the runtime
  token-absent path is unchanged — it's a bootstrap-timing check, not
  the opt-out).
- docs/approvals.md, docs/ci.md: drop stale forge.enable references.

Migration: configs that set `services.hyperhive.forge.enable = false`
must drop the line — the forge is now mandatory.

Prereq/companion to #1838 (PR-based config flow, which assumes the forge
is always present).

hive-c0re/src/bin/hivectl.rs

@@ -1019,7 +1019,7 @@ fn choom(name: &str, fresh: bool) -> Result<()> {
 async fn forge_create_user(name: &str, password: Option<&str>, password_stdin: bool) -> Result<()> {
     if !hive_c0re::forge::is_present().await {
         bail!(
-            "hive-forge container not running — start it (services.hyperhive.forge.enable = true) before provisioning forge users"
+            "hive-forge container not running — wait for hive-c0re to start it before provisioning forge users"
         );
     }
     let user_password = resolve_password(password, password_stdin)?;

hive-c0re/src/forge.rs

@@ -407,7 +407,7 @@ pub async fn ensure_user_for(name: &str) -> Result<()> {
 pub async fn provision_user_token(name: &str, password: Option<&str>) -> Result<String> {
     if !is_present().await {
         anyhow::bail!(
-            "hive-forge container not running — start it (services.hyperhive.forge.enable = true) before provisioning forge users"
+            "hive-forge container not running — wait for hive-c0re to start it before provisioning forge users"
         );
     }
     ensure_user_exists(name, false, password).await?;
@@ -661,7 +661,7 @@ pub fn core_token() -> Option<String> {
 
 /// Push `dir` (the meta repo) to `core/meta` on the local forge.
 /// Best-effort: returns Err which callers log + ignore. No-op when
-/// the core token isn't present (forge not enabled).
+/// the core token isn't present yet (forge container not provisioned).
 pub async fn push_meta(dir: &Path) -> Result<()> {
     let Some(token) = core_token() else {
         return Ok(());