hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

hive-agent/src/reminders.rs

@@ -18,7 +18,7 @@ use std::sync::Mutex;
 
 use anyhow::{Context, Result};
 use chrono::{DateTime, Utc};
-use hive_sh4re::approvals::ReminderStats;
+use hive_sh4re::inbox::ReminderStats;
 use hive_sh4re::wire_time;
 use rusqlite::{Connection, params};
 

hive-agent/src/stats.rs

@@ -15,7 +15,7 @@ use chrono::Utc;
 use rusqlite::{Connection, OpenFlags};
 use serde::Serialize;
 
-use hive_sh4re::approvals::ReminderStats;
+use hive_sh4re::inbox::ReminderStats;
 
 /// Window param accepted by `/api/stats?window=`. Each maps to a
 /// total span + the bucket width used to roll up trend series.

hive-agent/src/web_ui/stats.rs

@@ -29,7 +29,7 @@ pub(super) async fn api_stats(
 /// `HIVE_AGENT_SOCKET` — was a broker RPC before reminders moved
 /// in-container. Returns `None` on any transport / decode failure or
 /// when the socket is unset — the stats are decorative, not authoritative.
-async fn fetch_reminder_stats(window_secs: u64) -> Option<hive_sh4re::approvals::ReminderStats> {
+async fn fetch_reminder_stats(window_secs: u64) -> Option<hive_sh4re::inbox::ReminderStats> {
     match crate::todo_server::dial(&hive_agent_sock::Request::ReminderRollup {
         since_secs: window_secs,
     })