remove the hive's local build of agent closures

A rebuild or create downloads the closure the swarm built and applies it; with none to deploy it fails and changes nothing. hive-priv takes a store path instead of an internal/meta commit and builds nothing.

docs/agent-lifecycle/config-changes.md

@@ -145,9 +145,10 @@ commit the agent's last successful build pinned.
 
 swarm-controller commits `internal/meta`: one `flake.nix` and `flake.lock` for
 every agent any hive places (the pins:
-[`docs/swarm/builder.md`](../swarm/builder.md#meta-flake-lock)). A hive builds
-every agent from it. While the repo has no commit that pins an agent's current
-config, that agent's build fails and names the agent. The controller queues
+[`docs/swarm/builder.md`](../swarm/builder.md#meta-flake-lock)). The swarm
+builder builds every agent from it, and a hive deploys that build. While the
+repo has no commit that pins an agent's current config, that agent's deploy
+fails and names the agent. The controller queues
 its update of the repo before the deploy request for a merged config commit
 and for a new agent, and sends the deploy only when that update succeeded and
 the swarm builder built the agent from the updated repo (the
@@ -159,28 +160,23 @@ the swarm builder built the agent from the updated repo (the
   a custom agent from the config commit at the head of `agent-configs/<n>`
   `main`, an archetype agent from the archetype it has now. An agent switched
   between custom and archetype, or to another archetype, fails that test.
-  A hive without the forge credential file that nix's git reads, a repo with no
-  commit, a head that lacks the agent and a head behind the config each fail
-  the build with an error that names the agent. `MetaSync` records the commit,
+  A repo with no commit, a head that lacks the agent and a head behind the
+  config each fail the deploy with an error that names the agent. `MetaSync` records the commit,
   with the hyperhive and config commits the head pins, in `hive-c0re`'s own state,
   `/var/lib/hyperhive/meta-rev/<n>`, which the agent can't write (the container mounts its runtime
   directory read-write); `Prebuild` and `Swap` read that
-  record, so both build one flake. A first deploy resolves the commit in its `Create`
+  record, so both expect the closure of one commit. A first deploy resolves the commit in its `Create`
   node, since it has no `MetaSync`.
-- **The build.** `hive-c0re` prebuilds
-  `git+<forge>/internal/meta.git?rev=<commit>#nixosConfigurations.<n>…` and
-  names the commit to `hive-priv` (`meta_rev` on `UpdateContainer` and
-  `CreateContainer`). `hive-priv` accepts only a 40-digit lowercase hex
-  commit and builds the flake from its own forge URL
-  (`HIVE_PRIV_FORGE_URL`); the URL never comes from a request. On the wire the
+- **The closure.** The hive builds nothing. `Prebuild`, `Swap` and `Create` read
+  the agent's record in the swarm's `agent-closures` bucket (the controller
+  writes it from the builder's reply) and have `hive-priv` download the closure
+  it names from the swarm cache (`RealiseClosure`). `Swap` and `Create` then
+  give `hive-priv` the store path (`toplevel` on `UpdateContainer` and
+  `CreateContainer`), which accepts only a store path. On the wire the
   `hive_priv_sock::PrivRequest` variants carry a required field:
-  `{"op":"update_container","name":"atlas","stream":true,"meta_rev":"<40 hex>"}`.
-- **Fetching.** nix fetches the forge's inputs with `git`. Both `hive-c0re`
-  and `hive-priv` carry a `$HOME/.gitconfig` that answers for the forge host
-  through `git-credential-hive-forge` (the hive's forge read token, published to
-  `/run/hyperhive/forge-hive-token`) and rewrites the
-  forge's `https` URL, which `internal/meta`'s lock names its inputs by, to
-  `http`.
+  `{"op":"update_container","name":"atlas","stream":true,"toplevel":"/nix/store/<hash>-nixos-system-atlas"}`.
+  The three cases when the swarm's closure isn't the one this hive expects
+  are in [`docs/swarm/builder.md`](../swarm/builder.md#rebuilds-download-the-closure).
 - **Hyperhive.** The commit pins one hyperhive rev for the swarm, so an agent
   runs the hyperhive of the controller's deploy, not its hive's.
 - **Markers.** After a successful build `hive-c0re` writes the hyperhive