build agents only from internal/meta; delete the hive's local meta flake

The hive no longer renders, locks or commits a meta flake. A rebuild's
MetaSync node picks the internal/meta commit and records it with the
hyperhive and config pins it holds; Prebuild, Swap and Create build from it,
and a head that does not pin the agent's current config fails the build
naming the agent. hive-priv's meta_rev is required.

Removed: meta.rs sync/lock/render, the manual-rebuild relock, the boot
sweep's hyperhive bump (MetaLock), the update-meta-inputs form and its
panel, MetaWindow, the hive's hyperhive_rev setting.

Kept: agent_set::refresh holds what sync_agents also did (topology.json, the
gateway's agent-socket map and nginx include), called from spawn, destroy,
rebuild and the migration.

The boot reconcile and the stale-start upgrade compare the agent's marker
with the hyperhive pin of internal/meta; the dashboard's deployed chip reads
the config marker a successful build writes.

docs/agent-lifecycle/agent-roster.md

@@ -25,7 +25,7 @@ create` (or the swarm UI, via `POST /api/agents`) writes that identity
 once, by calling `ensure_agent_identity`.
 
 This page is about a different, **hive-local** file: the hive-c0re-owned
-**meta repo**, alongside `flake.nix`, at
+`meta/` directory's `topology.json`, at
 `/var/lib/hyperhive/meta/topology.json`:
 
 ```json
@@ -102,10 +102,8 @@ state dirs work as for every other agent.
   `/var/lib/hyperhive/agents` bind-mounted RW at `/agents` (so it can
   manage any agent's state dir — config isn't authored there, since a
   real config change is a PR from a clone), plus RO mounts for
-  `/applied` (diff against what's deployed) and `/meta` (system-wide
-  deploy log). Any agent holding it gets the same mounts.
-  The operator dashboard's `POST /api/meta-update` is the only path
-  that writes `flake.lock`.
+  `/applied` (diff against what's deployed) and `/meta` (the hive's
+  topology and limits files). Any agent holding it gets the same mounts.
 - **Prompt** — identical for every container but one block (below):
   `prompts/system.md`
   carries `<!-- role:agent -->` / `<!-- role:manager -->` marker