collapse the roles.json mount grant into the ManageRootAgent capability

The hive had two spellings of "this agent may act on agents that aren't
its children": the `ManageRootAgent` capability, which nothing checked,
and a `can_manage_top_level_agents` role in a third meta store,
`roles.json`, which owned the real grant — the bind mounts that put
another agent's state (rw) and config (ro) inside the holder's
container. The two drifted independently, and with the parent/child
hierarchy removed the role's set (`parent.is_none()`) silently became
every agent while nothing said so.

Collapse them. The mount grant now hangs off
`Capability::ManageRootAgent`, looked up through the one capability
path that already exists (`capabilities::has_cap` over
`capabilities.json`) rather than a second mechanism. `roles.json` and
everything that read, wrote or reconciled it is gone, along with its
`meta.rs` staging and commit-label wiring; nothing in the tree reads
that file any more.

The enum variant keeps its name deliberately. Renaming it would turn
every `manage_root_agent` already stored in `capabilities.json` into an
unrecognised name that `prune_unknown` drops without asking. Its
meaning, not its spelling, is what changed: "may manage any agent". The
doc comment and the description string now say that.

`top_level_agents()`/`top_level_agents_in()` are replaced by
`all_agents()`/`all_agents_in()`. Under "manage any agent" the mounted
set is every agent by definition, so the code states it instead of
deriving it from a predicate that no longer discriminates — and the
call-site comment explains that, because it otherwise reads as a
widening. The holder is no longer bound as its own virtual child: that
reproduced the own-state and own-config mounts exactly, so dropping it
loses nothing.

hive-c0re/src/lifecycle/host_config.rs

@@ -6,6 +6,7 @@ use std::path::{Path, PathBuf};
 
 use anyhow::{Context, Result};
 use hive_priv_sock::{BindMount, CredentialMount};
+use hive_sh4re::permissions::Capability;
 
 use crate::coordinator::{AgentPaths, HiveEnv};
 
@@ -323,18 +324,28 @@ async fn set_nspawn_flags(
         bind_child_agent_dirs(child, &mut binds);
     }
 
-    // `can_manage_top_level_agents` role: additionally mount every
-    // parentless agent in the topology as a virtual child. Enables
-    // recovery — a role holder can update those agents' configs even
-    // when they are down. Also grants RO access to /applied and /meta.
-    if crate::topology::has_role(
-        agent_name,
-        crate::topology::ROLE_CAN_MANAGE_TOP_LEVEL_AGENTS,
-    ) {
-        let top_level = crate::topology::top_level_agents();
-        for tl in &top_level {
-            if !direct_children.contains(tl) {
-                bind_child_agent_dirs(tl, &mut binds);
+    // `ManageRootAgent` capability: additionally mount *every* agent in
+    // the hive as a virtual child. Enables recovery — the holder can
+    // update another agent's config even when that agent is down. Also
+    // grants RO access to /applied and /meta.
+    //
+    // ⚠️ "every agent" reads as a widening next to the `children_of`
+    // mounts above, so: it is the definition of this capability, not an
+    // accident of how the set is computed. The grant used to hang off a
+    // `can_manage_top_level_agents` role and cover `top_level_agents()`
+    // — i.e. `parent.is_none()` — which was "everything outside the
+    // hierarchy". With the hierarchy gone (#4472) every agent is
+    // parentless, so that set *was* every agent anyway; the capability
+    // now says so out loud instead of deriving it from a field that no
+    // longer discriminates.
+    if crate::capabilities::has_cap(agent_name, Capability::ManageRootAgent) {
+        // Skipping self is a no-op, not a narrowing: `agent_notes_dir` is
+        // `agent_state_dir/state` and `config_bind_source` is shared, so
+        // binding the holder as its own virtual child reproduced the two
+        // own-dir mounts pushed above, byte for byte.
+        for other in crate::topology::all_agents() {
+            if other != agent_name && !direct_children.contains(&other) {
+                bind_child_agent_dirs(&other, &mut binds);
             }
         }
         // systemd-nspawn refuses to start a container whose bind