refactor(#3434): the job nodes carry the agent, not the repo too

Every repo in this graph is `agents/<agent>` -- the node payloads were
carrying the same string under two names, and `create_agent` opened with
a `let repo = agent.clone()` that said so out loud.

All four node kinds now carry `agent` alone, and `forge::agent_repo` is
the single home for the naming convention. The identity it returns is the
point: a caller holding an agent name never writes a repo name itself, so
changing the convention later is one edit rather than a search.

`forge::Client`'s methods keep taking a repo, because they are a general
forge client and `add_repo_member(repo, user)` is a real signature -- the
derivation belongs at the call site that knows the two are the same here,
not baked into an API that has no reason to assume it.

`data()`'s four arms are now identical and merged into one or-pattern.
Left as an explicit list rather than a catch-all so a fifth variant fails
to compile here instead of silently rendering as an agent name.

swarm-controller/src/forge.rs

@@ -33,6 +33,18 @@ use crate::webhook::DeliveryKind;
 /// the same forge instance, not a separate one, so the same org.
 pub const AGENTS_ORG: &str = "agents";
 
+/// The repo an agent's config lives in — one repo per agent inside
+/// [`AGENTS_ORG`], named after the agent.
+///
+/// The identity here is the point, not an accident to be inlined: this is
+/// the single home for the naming convention, so a caller holding an agent
+/// name never writes the repo name itself. Callers used to pass both, which
+/// meant every node payload carried the same string twice and any future
+/// change to the convention would have been a search rather than an edit.
+pub fn agent_repo(agent: &str) -> &str {
+    agent
+}
+
 /// The `operators` team, whitelisted for the merge gate on every repo
 /// this client protects — provisioned by `hive-c0re::forge::repos`
 /// already (`ensure_operators_team`), not re-provisioned here. If that