build agents only from internal/meta; delete the hive's local meta flake

The hive no longer renders, locks or commits a meta flake. A rebuild's
MetaSync node picks the internal/meta commit and records it with the
hyperhive and config pins it holds; Prebuild, Swap and Create build from it,
and a head that does not pin the agent's current config fails the build
naming the agent. hive-priv's meta_rev is required.

Removed: meta.rs sync/lock/render, the manual-rebuild relock, the boot
sweep's hyperhive bump (MetaLock), the update-meta-inputs form and its
panel, MetaWindow, the hive's hyperhive_rev setting.

Kept: agent_set::refresh holds what sync_agents also did (topology.json, the
gateway's agent-socket map and nginx include), called from spawn, destroy,
rebuild and the migration.

The boot reconcile and the stale-start upgrade compare the agent's marker
with the hyperhive pin of internal/meta; the dashboard's deployed chip reads
the config marker a successful build writes.

AGENTS.md

@@ -52,7 +52,7 @@ Per-hive (host + in-container):
 
 - **`hive-c0re/`** — host daemon (runs as the unprivileged `hive-core`
   user), **daemon-only** — the operator CLI is `hivectl`. Owns the sqlite
-  broker, reminder queue, meta flake, lifecycle (`nixos-container`
+  broker, reminder queue, lifecycle (`nixos-container`
   shellouts), gateway wiring, per-container stats and the axum operator
   dashboard. Agent forge/matrix accounts are `swarm-controller`'s. Largest
   crate.
@@ -95,8 +95,8 @@ Per-hive (host + in-container):
   utility crate.
 - **`hive-metric/`** — one-shot CLI pushing a labeled metric over OTLP.
 - **`hive-meta-flake/`** — the meta flake's `flake.nix` text, a pure
-  render, and the reads of its pins. hive-c0re and swarm-controller both call
-  it.
+  render, and the reads of its pins. swarm-controller renders with it;
+  hive-c0re reads the pins of the `internal/meta` it builds from.
 
 Wire types + socket plumbing: