hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

hive-c0re/README.md

@@ -1,7 +1,7 @@
 # hive-c0re
 
 The unprivileged host daemon (runs as `hive-core`). Owns the sqlite
-broker, the approval/reminder queues, the generic job-DAG
+broker, the reminder queue, the generic job-DAG
 queue, container lifecycle, gateway vhost wiring, forge/matrix config
 reconciliation, per-container stats, and the axum operator dashboard.
 Largest crate in the workspace — bin-only, no separate lib.
@@ -9,7 +9,7 @@ Largest crate in the workspace — bin-only, no separate lib.
 ## When to use it
 
 Host-level, cross-container orchestration: spawning/rebuilding/
-destroying agent containers, the approval flow, dashboard-visible
+destroying agent containers, dashboard-visible
 state, wiring each agent's gateway vhost and reconciling its forge
 config-repo access and matrix room membership. The accounts themselves
 are swarm-controller's (`docs/integrations/forge.md`). Agent-side
@@ -25,7 +25,7 @@ subdirectory a module actually lives in). One line each — read the
 module's own `//!` doc-comment for real detail, don't expect this file
 to track it:
 
-- **`dashboard/`** — the operator dashboard (containers, approvals,
+- **`dashboard/`** — the operator dashboard (containers,
   schedules, logs, topology).
 - **`job_queue/`** — the job-DAG queue + desired-state reconciliation
   (`docs/scheduler/coordinator.md`).