build agents only from internal/meta; delete the hive's local meta flake

The hive no longer renders, locks or commits a meta flake. A rebuild's
MetaSync node picks the internal/meta commit and records it with the
hyperhive and config pins it holds; Prebuild, Swap and Create build from it,
and a head that does not pin the agent's current config fails the build
naming the agent. hive-priv's meta_rev is required.

Removed: meta.rs sync/lock/render, the manual-rebuild relock, the boot
sweep's hyperhive bump (MetaLock), the update-meta-inputs form and its
panel, MetaWindow, the hive's hyperhive_rev setting.

Kept: agent_set::refresh holds what sync_agents also did (topology.json, the
gateway's agent-socket map and nginx include), called from spawn, destroy,
rebuild and the migration.

The boot reconcile and the stale-start upgrade compare the agent's marker
with the hyperhive pin of internal/meta; the dashboard's deployed chip reads
the config marker a successful build writes.

frontend/packages/dashboard/src/tabs.js

@@ -27,11 +27,8 @@ import {
 import {
   initBuilds,
   onBuildsTabShown,
-  onMetaInputsChanged,
-  onMetaUpdateRunning,
   onRebuildQueueChanged,
   rebuildCount,
-  syncBuildsFromSnapshot,
 } from "./builds.js";
 import {
   applyTombstonesChanged,
@@ -160,7 +157,7 @@ import { renderUserMenu } from "./user-menu.js";
       // initJobqRollup mounts once and is a no-op on later calls; the
       // mount's own effect handles the actual fetch.
       initJobqRollup();
-      syncBuildsFromSnapshot(s);
+
       syncKeptFromSnapshot(s);
       renderContainers(s);
       renderKept();
@@ -216,8 +213,7 @@ import { renderUserMenu } from "./user-menu.js";
       applyRebuildQueueChanged();
       onRebuildQueueChanged();
     },
-    meta_inputs_changed: onMetaInputsChanged,
-    meta_update_running: onMetaUpdateRunning,
+
     tombstones_changed: applyTombstonesChanged,
   };
   (function bindDashboardStream() {
@@ -229,12 +225,12 @@ import { renderUserMenu } from "./user-menu.js";
     // fallback when SharedWorker isn't supported.
     //
     // kinds= matches MUTATION_HANDLERS verbatim, so the stream carries
-    // only the 8 wire kinds this page acts on.
+    // only the 6 wire kinds this page acts on.
     const es = openStream(
       "/api/dashboard/stream?kinds=" +
         "transient_set,transient_cleared," +
         "container_state_changed,container_removed,rebuild_queue_changed," +
-        "meta_inputs_changed,meta_update_running,tombstones_changed",
+        "tombstones_changed",
     );
     es.onmessage = (e) => {
       let ev;
@@ -266,7 +262,7 @@ import { renderUserMenu } from "./user-menu.js";
   })();
 
   // ─── tab routing ───────────────────────────────────────────────────────
-  // Hash-based: `#agents` / `#rebuild` / `#meta` / `#buildlogs` / `#kept`
+  // Hash-based: `#agents` / `#rebuild` / `#buildlogs` / `#kept`
   // activate the matching pane on the dashboard. Empty
   // hash defaults to 4G3NTS. ST4TS is NOT a tab — it is a separate page
   // (`/stats.html`) reached from the pages menu (links-menu.js). Tab routing