agent permissions: drop hive-c0re's swarm-agent-permissions.json fallback, fail closed before the first read

Removes the HiveCopy hand-off: hive-c0re no longer writes each agent's
entry from swarm-agent-permissions.json into its runtime dir as
swarm-permissions.json, and the harness and subagent daemon no longer
read it. hive-c0re keeps the file as its own last read of the swarm for
the manage_root_agent mounts. Also removes permissions_import::pending(),
its only caller being the hand-off. No nix provisioned the copy, so no
nix option is removed and no tombstone is needed.

Rule after this change: until an agent's first successful read of its
key it holds no permissions (no execution, so no bash), and a subagent it
starts holds the same. After a read a set key wins, [] holds none and an
unset key is the default. A failed read keeps the last value, so an
unreachable queue at start keeps the agent closed until a read succeeds.
The harness logs once at warn that it starts closed.

Fixes #5315

docs/agent-lifecycle/persistence.md

@@ -430,9 +430,7 @@ holds the permissions the swarm grants this hive's agents, as
 `workers::swarm_permissions` last read them from the swarm's
 `agent-permissions` bucket (every 30 seconds): a copy, not the
 record, which `swarmctl agent permissions` sets. `set_nspawn_flags`
-reads it at every container start for `manage_root_agent`. Each agent gets
-its own entry from it as `swarm-permissions.json` in its runtime dir, which
-it holds until its own first read of its key succeeds.
+reads it at every container start for `manage_root_agent`.
 
 `/var/lib/hyperhive/swarm-agent-archetypes.json` holds the archetype each of
 this hive's archetype agents runs, as last read from the swarm's

docs/process/conventions.md

@@ -322,12 +322,11 @@ none.
   `/var/lib/hyperhive/swarm-agent-permissions.json`, outside the meta repo.
   nspawn fixes the bind mounts at container start, so when an agent's
   `manage_root_agent` changes hive-c0re restarts it after its current turn.
-- hive-c0re copies each agent's entry from that file into the agent's
-  runtime dir (`/run/hive/swarm-permissions.json` in the container) at every
-  start and after every 30-second pass, with whether the import below is
-  still pending. The harness and the subagent daemon hold that copy until
-  their own first read succeeds, so an agent whose queue is down starts on
-  its last stored grant, not the default.
+- Until its first read succeeds, an agent holds no permissions: no
+  `execution` (so no `bash`), only the always-on tools. A subagent it starts
+  holds the same. After a read, an unset key means the default. A failed read
+  keeps the last value read, so an unreachable queue at start keeps the agent
+  closed until a read succeeds.
 
 Every reader keeps its last good value on a failed read.
 
@@ -338,8 +337,10 @@ sends them to swarm-controller once as one list per agent (without
 only where there is none, and only for agents that hive's wanted state
 declares), and deletes
 both files from the meta repo when the controller answers
-(`workers/permissions_import.rs`). Until then hive-c0re reads no keys, and an
-agent that reads its own key unset keeps the grant in its copy.
+(`workers/permissions_import.rs`). Until then hive-c0re reads no keys. An
+agent reads a key the controller hasn't yet written as unset, the default,
+so an agent whose meta grant differs from the default holds the default
+until the import lands.
 
 **Not configurable from `agent.nix`** — that file changes through config PRs
 an agent can open, so letting it declare its own permissions would let an