build agents only from internal/meta; delete the hive's local meta flake

The hive no longer renders, locks or commits a meta flake. A rebuild's
MetaSync node picks the internal/meta commit and records it with the
hyperhive and config pins it holds; Prebuild, Swap and Create build from it,
and a head that does not pin the agent's current config fails the build
naming the agent. hive-priv's meta_rev is required.

Removed: meta.rs sync/lock/render, the manual-rebuild relock, the boot
sweep's hyperhive bump (MetaLock), the update-meta-inputs form and its
panel, MetaWindow, the hive's hyperhive_rev setting.

Kept: agent_set::refresh holds what sync_agents also did (topology.json, the
gateway's agent-socket map and nginx include), called from spawn, destroy,
rebuild and the migration.

The boot reconcile and the stale-start upgrade compare the agent's marker
with the hyperhive pin of internal/meta; the dashboard's deployed chip reads
the config marker a successful build writes.

hive-c0re/src/dashboard_events.rs

@@ -7,7 +7,7 @@
 use serde::Serialize;
 
 use crate::container_view::ContainerView;
-use crate::dashboard::{MetaInputView, TombstoneView};
+use crate::dashboard::TombstoneView;
 use chrono::{DateTime, Utc};
 
 #[derive(Debug, Clone, Serialize)]
@@ -96,26 +96,7 @@ pub enum DashboardEvent {
         seq: u64,
         tombstones: Vec<TombstoneView>,
     },
-    /// Full snapshot of `meta/flake.lock`'s root inputs. Emitted
-    /// after every operation that bumps a lock: `meta-update`,
-    /// `rebuild_agent` (lock bumps via two-phase staging),
-    /// `update-all`. Same snapshot-shape rationale as
-    /// `TombstonesChanged` — the list is small (one row per agent
-    /// plus their fetched inputs).
-    MetaInputsChanged {
-        seq: u64,
-        inputs: Vec<MetaInputView>,
-    },
-    /// A dashboard-triggered `meta-update` started (`running: true`) or
-    /// finished (`running: false`). `post_meta_update` returns 200
-    /// immediately and runs the `nix flake update` + agent-rebuild
-    /// ripple in a background task — this event lets the META INPUTS
-    /// panel show a disabled "updating…" state for that whole window
-    /// instead of looking idle. Emitted by
-    /// `Coordinator::meta_update_guard` / `MetaUpdateGuard::drop` only
-    /// when the active-run count crosses 0, so concurrent updates flip
-    /// the flag exactly once.
-    MetaUpdateRunning { seq: u64, running: bool },
+
     /// The job queue changed — **a bare trigger, no payload.**
     ///
     /// It used to carry a full typed snapshot of the queue. Nothing reads
@@ -153,8 +134,7 @@ impl DashboardEvent {
             DashboardEvent::ContainerStateChanged { .. } => "container_state_changed",
             DashboardEvent::ContainerRemoved { .. } => "container_removed",
             DashboardEvent::TombstonesChanged { .. } => "tombstones_changed",
-            DashboardEvent::MetaInputsChanged { .. } => "meta_inputs_changed",
-            DashboardEvent::MetaUpdateRunning { .. } => "meta_update_running",
+
             DashboardEvent::RebuildQueueChanged { .. } => "rebuild_queue_changed",
         }
     }
@@ -219,14 +199,6 @@ mod tests {
                 seq: 1,
                 tombstones: Vec::new(),
             },
-            DashboardEvent::MetaInputsChanged {
-                seq: 1,
-                inputs: Vec::new(),
-            },
-            DashboardEvent::MetaUpdateRunning {
-                seq: 1,
-                running: false,
-            },
             DashboardEvent::RebuildQueueChanged { seq: 1 },
         ];
         for ev in samples {