hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

hive-c0re/src/dashboard/mod.rs

@@ -1,6 +1,5 @@
 //! Hyperhive dashboard. Lists managed containers (with deep-links to each
-//! container's web UI), pending approvals (with unified diff vs the applied
-//! repo, plus approve/deny buttons), and the manager.
+//! container's web UI) and the manager.
 
 use std::net::SocketAddr;
 use std::sync::Arc;
@@ -35,7 +34,6 @@ use crate::lifecycle;
     tags(
         (name = "health", description = "hive-wide liveness/readiness probes"),
         (name = "journal", description = "container + host journal reads"),
-        (name = "approvals", description = "approve/deny pending approval rows"),
         (name = "build_logs", description = "build log headers, full rows, and raw text downloads"),
         (name = "lifecycle_ops", description = "agent container lifecycle: rebuild/restart/start/stop/pause/limits"),
         (name = "meta_inputs", description = "bulk flake-input update for the meta flake"),
@@ -49,7 +47,6 @@ use crate::lifecycle;
 )]
 struct ApiDoc;
 
-mod approvals;
 mod build_logs;
 // The single validated identifier type — homed in `hive-host-sock` (the crate
 // owning agent-path facts) so every dashboard path-param validates through the
@@ -142,8 +139,6 @@ pub async fn serve(port: u16, coord: Arc<Coordinator>) -> Result<()> {
         .routes(routes!(permissions::delete_agent_permissions))
         .routes(routes!(schedules::api_schedules))
         .routes(routes!(schedules::post_rebuild_queue_cancel))
-        .routes(routes!(approvals::post_approve))
-        .routes(routes!(approvals::post_deny))
         .routes(routes!(lifecycle_ops::post_destroy))
         .routes(routes!(lifecycle_ops::post_kill))
         .routes(routes!(lifecycle_ops::post_restart))
@@ -360,8 +355,6 @@ mod router_build_probe {
             .routes(routes!(permissions::delete_agent_permissions))
             .routes(routes!(schedules::api_schedules))
             .routes(routes!(schedules::post_rebuild_queue_cancel))
-            .routes(routes!(approvals::post_approve))
-            .routes(routes!(approvals::post_deny))
             .routes(routes!(lifecycle_ops::post_destroy))
             .routes(routes!(lifecycle_ops::post_kill))
             .routes(routes!(lifecycle_ops::post_restart))