build agents only from internal/meta; delete the hive's local meta flake

The hive no longer renders, locks or commits a meta flake. A rebuild's
MetaSync node picks the internal/meta commit and records it with the
hyperhive and config pins it holds; Prebuild, Swap and Create build from it,
and a head that does not pin the agent's current config fails the build
naming the agent. hive-priv's meta_rev is required.

Removed: meta.rs sync/lock/render, the manual-rebuild relock, the boot
sweep's hyperhive bump (MetaLock), the update-meta-inputs form and its
panel, MetaWindow, the hive's hyperhive_rev setting.

Kept: agent_set::refresh holds what sync_agents also did (topology.json, the
gateway's agent-socket map and nginx include), called from spawn, destroy,
rebuild and the migration.

The boot reconcile and the stale-start upgrade compare the agent's marker
with the hyperhive pin of internal/meta; the dashboard's deployed chip reads
the config marker a successful build writes.

nix/host-modules/hive-c0re/default.nix

@@ -82,7 +82,7 @@ let
   # c0re binary itself changes.
   serveConfigJson = builtins.toJSON {
     hyperhive_flake = cfg.hyperhiveFlake;
-    hyperhive_rev = cfg.hyperhiveRev;
+
     # The `claude-code` every agent runs, or null for "each agent keeps
     # the one out of its own nixpkgs". `builtins.toJSON` serialises a
     # derivation as its out path (and null as null), so the package goes
@@ -337,8 +337,7 @@ in
         # - nix is invoked directly (lifecycle, meta, flake_check), but
         #   NIX_REMOTE=daemon routes all store writes through the host
         #   daemon — hive-c0re never writes to /nix itself.
-        # - flake.lock ops land in the meta worktree under StateDirectory
-        #   (kept writable by systemd).
+
         # - nix build worktrees live in PrivateTmp, not /tmp.
         # - /etc writes (bind-mount edits) go through hive-priv via the
         #   privileged socket; /etc/hyperhive/serve.json is read-only.