feat(#1867): make the internal forge mandatory (remove forge.enable)

The internal forge is the canonical store for the meta flake, every
agent's config repo, and the internal/* repos, so it can no longer be
optional. Remove the services.hyperhive.forge.enable toggle:

- hive-forge.nix: drop the `enable` option; the forge config now
  deploys gated on `services.hyperhive.enable` (it ships with hyperhive).
- hive-c0re.nix: HIVE_FORGE_URL env unconditional; forge-public-URL gate
  drops the enable check (keeps behindGateway).
- hive-gateway.nix: local /etc/hosts forge entry keyed on behindGateway.
- hive-ci.nix: drop the now-moot `forge.ci.enable requires forge.enable`
  assertion (forge is always present); reword the option doc.
- nix/docs/default.nix: drop the `forge.enable = mkForce false` stub
  (option gone); the options-doc eval stays light via hyperhive.enable.
- hive-c0re forge.rs / hivectl.rs: reword 'forge.enable = true' error
  text to 'wait for hive-c0re to start the container' (the runtime
  token-absent path is unchanged — it's a bootstrap-timing check, not
  the opt-out).
- docs/approvals.md, docs/ci.md: drop stale forge.enable references.

Migration: configs that set `services.hyperhive.forge.enable = false`
must drop the line — the forge is now mandatory.

Prereq/companion to #1838 (PR-based config flow, which assumes the forge
is always present).

nix/modules/hive-ci.nix

@@ -193,8 +193,8 @@ in
         Run a Forgejo Actions runner in a `hive-ci` nixos-container.
         Grouped under `services.hyperhive.forge` because the runner is
         tightly coupled to the forge instance it registers against.
-        Disabled by default; `services.hyperhive.forge.enable = true` is
-        a prerequisite (enforced by assertion).
+        Disabled by default; the internal forge it registers against is
+        always present (mandatory), so enabling this is all that's needed.
 
         On first start the container auto-registers against hive-forge using
         hive-c0re's admin token — no manual token provisioning needed.
@@ -265,16 +265,9 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = forgeCfg.enable;
-        message = ''
-          services.hyperhive.forge.ci.enable = true requires
-          services.hyperhive.forge.enable = true — the runner registers
-          against the hive-forge Forgejo instance.
-        '';
-      }
-    ];
+    # No forge-presence assertion needed: the internal forge is mandatory
+    # (deploys with hyperhive), so the runner always has an instance to
+    # register against.
 
     # Create /run/hive-ci/ on the host and seed runner-token with a
     # placeholder. hive-ci-prefetch.service overwrites it with the real