agent permissions: a destroyed agent's key goes with it

Declaring an agent Destroyed now deletes its `agent-permissions` key,
next to the queue-credential revoke and with the same failure handling:
logged at error, the destroy goes ahead, and declaring it destroyed
again re-runs it. Agent names are reusable after a destroy, and a create
left on the default stores no key, so the old key handed a new agent of
the same name the destroyed agent's grant (argus on #5293).

Also: migrate.rs's create-time-setup note named ruth's tool-group seed
in `ensure_root_agent`, which this PR deletes; it now says she holds the
code-constant default when the swarm sets nothing.

Part of #5170.

hive-c0re/src/migrate.rs

@@ -10,10 +10,11 @@
 //!   `h-root`); both targeted layouts no live hive still has. Add one
 //!   only if it cannot be expressed as convergence, and expect to delete
 //!   it once every hive has passed it.
-//! - **Create-time setup.** Ruth's tool groups were backfilled here on
-//!   every boot; they are now seeded where she is created
-//!   (`workers::auto_update::ensure_root_agent`). A thing that is true
-//!   from birth does not need re-asserting each morning.
+//! - **Create-time setup.** A thing that is true from birth is set where
+//!   the agent is created, not re-asserted each morning. Ruth's
+//!   permissions need neither: with no key in the swarm's
+//!   `agent-permissions` bucket she holds the code-constant default
+//!   (`Permission::default_for`).
 //!
 //! Kill-switch: `HIVE_SKIP_META_MIGRATION=1`. Full sequence and phase
 //! details: `docs/agent-lifecycle/config-changes.md::Startup migrations (older hosts)`.