hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

docs/tools/hivectl-cli.md

@@ -37,10 +37,6 @@ This document contains the help content for the `hivectl` command-line program.
 * [`hivectl agent subvol snapshot push`↴](#hivectl-agent-subvol-snapshot-push)
 * [`hivectl list-agents`↴](#hivectl-list-agents)
 * [`hivectl quota-enable`↴](#hivectl-quota-enable)
-* [`hivectl approvals`↴](#hivectl-approvals)
-* [`hivectl approvals pending`↴](#hivectl-approvals-pending)
-* [`hivectl approvals approve`↴](#hivectl-approvals-approve)
-* [`hivectl approvals deny`↴](#hivectl-approvals-deny)
 * [`hivectl wg`↴](#hivectl-wg)
 * [`hivectl wg init`↴](#hivectl-wg-init)
 * [`hivectl wg peer`↴](#hivectl-wg-peer)
@@ -66,7 +62,6 @@ Sibling to the `hive-c0re` daemon binary. Covers host-side admin operations that
 * `agent` — Lifecycle actions on ONE managed agent container. Needs the hive-c0re daemon running
 * `list-agents` — Show all managed agents with their status and technical state
 * `quota-enable` — Enable btrfs qgroup accounting on the agent-state filesystem
-* `approvals` — Operator approval queue: list, approve, or deny pending requests
 * `wg` — WireGuard inter-hive mesh setup helpers
 * `peer-config` — Generate the federation peer-config block for THIS hive
 * `stop` — Stop containers hive-wide in one operator action
@@ -524,54 +519,6 @@ Global one-shot toggle (not per-agent), hence top-level rather than under `hivec
 
 
 
-## `hivectl approvals`
-
-Operator approval queue: list, approve, or deny pending requests.
-
-Needs the hive-c0re daemon running.
-
-**Usage:** `hivectl approvals <COMMAND>`
-
-###### **Subcommands:**
-
-* `pending` — List pending approval requests submitted by agents
-* `approve` — Approve a pending request by id; the action runs immediately
-* `deny` — Deny a pending request by id
-
-
-
-## `hivectl approvals pending`
-
-List pending approval requests submitted by agents
-
-**Usage:** `hivectl approvals pending`
-
-
-
-## `hivectl approvals approve`
-
-Approve a pending request by id; the action runs immediately
-
-**Usage:** `hivectl approvals approve <ID>`
-
-###### **Arguments:**
-
-* `<ID>` — Approval id (from `hivectl approvals pending`)
-
-
-
-## `hivectl approvals deny`
-
-Deny a pending request by id
-
-**Usage:** `hivectl approvals deny <ID>`
-
-###### **Arguments:**
-
-* `<ID>` — Approval id
-
-
-
 ## `hivectl wg`
 
 WireGuard inter-hive mesh setup helpers.