build agents only from internal/meta; delete the hive's local meta flake

The hive no longer renders, locks or commits a meta flake. A rebuild's
MetaSync node picks the internal/meta commit and records it with the
hyperhive and config pins it holds; Prebuild, Swap and Create build from it,
and a head that does not pin the agent's current config fails the build
naming the agent. hive-priv's meta_rev is required.

Removed: meta.rs sync/lock/render, the manual-rebuild relock, the boot
sweep's hyperhive bump (MetaLock), the update-meta-inputs form and its
panel, MetaWindow, the hive's hyperhive_rev setting.

Kept: agent_set::refresh holds what sync_agents also did (topology.json, the
gateway's agent-socket map and nginx include), called from spawn, destroy,
rebuild and the migration.

The boot reconcile and the stale-start upgrade compare the agent's marker
with the hyperhive pin of internal/meta; the dashboard's deployed chip reads
the config marker a successful build writes.

docs/integrations/forge.md

@@ -75,8 +75,7 @@ forge container:
 
 - fetching a merged config commit for a swarm deploy, and
   `hivectl forge reconcile-config`
-- reseeding a purged `applied` repo, and the meta-update cascade's
-  fast-forward of `applied/main`
+- reseeding a purged `applied` repo
 - seeding `proposed` from `agent-configs/<agent>` on first deploy
 - cloning and pulling `/knowledge`
 
@@ -84,7 +83,7 @@ The builds themselves read as `core`. nix fetches the config inputs and
 `internal/meta` with `git`, and `git` gets its credential from
 `git-credential-hive-forge`, which reads the `core` token file. A hive without
 that file fetches nothing private through nix, whatever its own token reads, so
-it builds from its own meta flake rather than `internal/meta`.
+its builds fail: they have no other flake than `internal/meta`.
 
 Roll a change to any of this out store host first (its granter writes the
 controller's grant on `swarm/hives/+/forge/token`), then the controller host,