hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

hive-c0re/src/dashboard/state_snapshot.rs

@@ -13,8 +13,6 @@ use axum::{
         sse::{Event, KeepAlive, Sse},
     },
 };
-use chrono::{DateTime, Utc};
-use hive_sh4re::approvals::Approval;
 use serde::{Deserialize, Serialize};
 use tokio_stream::wrappers::BroadcastStream;
 use tokio_stream::{Stream, StreamExt};
@@ -24,7 +22,7 @@ use crate::container_view::ContainerView;
 
 use super::meta_inputs::{MetaInputView, read_meta_inputs};
 use super::tombstones::{TombstoneView, build_tombstone_views};
-use super::{AppState, approvals, error_response, scan_validated_paths};
+use super::{AppState, error_response, scan_validated_paths};
 
 #[allow(clippy::struct_excessive_bools)]
 #[derive(Serialize)]
@@ -48,10 +46,6 @@ pub(super) struct StateSnapshot {
     any_stale: bool,
     containers: Vec<ContainerView>,
     transients: Vec<TransientView>,
-    approvals: Vec<ApprovalView>,
-    /// Last 30 resolved approvals (approved / denied / failed), newest-
-    /// first. Drives the "history" tab on the approvals section.
-    approval_history: Vec<ApprovalHistoryView>,
     /// State dirs (config history + claude creds + /state/ notes) that
     /// survive after a destroy-without-purge. The operator can re-spawn
     /// with the same name to resume, or PURG3 to wipe them.
@@ -70,8 +64,8 @@ pub(super) struct StateSnapshot {
     /// `MetaUpdateRunning` event.
     meta_update_running: bool,
     /// Whether the hive-forge container is up. When true the dashboard
-    /// links each container's config + each approval's commit into the
-    /// forge's `agent-configs` repos.
+    /// links each container's config into the forge's `agent-configs`
+    /// repos.
     forge_present: bool,
     /// Whether `hive-gateway` is in front of this dashboard. Sourced
     /// from the `HIVE_GATEWAY_ENABLED` env var, which the c0re NixOS
@@ -126,60 +120,6 @@ struct TransientView {
     secs: u64,
 }
 
-#[derive(Serialize)]
-struct ApprovalHistoryView {
-    id: i64,
-    agent: String,
-    kind: &'static str,
-    /// First 12 chars of the manager-supplied ref. None when it is empty.
-    sha_short: Option<String>,
-    /// `approved` / `denied` / `failed`.
-    status: &'static str,
-    /// RFC 3339 UTC. Renders as a relative time on the dashboard.
-    resolved_at: DateTime<Utc>,
-    /// Operator-supplied deny reason (for `denied`) or build error
-    /// (for `failed`). None on `approved`.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    note: Option<String>,
-}
-
-#[derive(Serialize)]
-struct ApprovalView {
-    id: i64,
-    agent: String,
-    kind: &'static str,
-    /// Manager-supplied description shown on the approval card.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    description: Option<String>,
-    /// Raw `commit_ref` payload for `UpdateMetaInputs` (JSON-encoded
-    /// `Vec<String>` of input names; `"[]"` = all inputs). The
-    /// frontend parses this to render a human-readable card body.
-    commit_ref: String,
-    /// RFC 3339 UTC time the approval was queued. Rendered as a
-    /// relative time on the card so the operator can spot a stale
-    /// request.
-    requested_at: DateTime<Utc>,
-}
-
-/// Replace silent `.unwrap_or_default()` on the data sources behind
-/// `/api/state` so that whichever query degrades surfaces in journald
-/// instead of leaving the operator staring at an empty list. The
-/// dashboard still degrades to a sensible default value; the warn
-/// is just the diagnostic breadcrumb the old code swallowed.
-fn log_default<T, E>(what: &str, result: std::result::Result<T, E>) -> T
-where
-    T: Default,
-    E: std::fmt::Debug,
-{
-    match result {
-        Ok(v) => v,
-        Err(e) => {
-            tracing::warn!(target: "api_state", source = %what, error = ?e, "snapshot source failed; using default");
-            T::default()
-        }
-    }
-}
-
 /// Window over which container crashes count toward the `agents_crashing`
 /// banner warning. Wide enough that a crash-looping container (restarted
 /// by `Restart=on-failure` every few seconds) keeps the warning lit
@@ -189,12 +129,11 @@ const CRASH_WARNING_WINDOW: std::time::Duration = std::time::Duration::from_mins
 
 /// Cold-load snapshot of the whole dashboard.
 ///
-/// Includes the roster, approvals (+ history),
-/// tombstones, job queue, meta inputs, and more. Live clients then
-/// follow `/api/dashboard/stream` (SSE) for incremental updates keyed
-/// off `seq`.
+/// Includes the roster, tombstones, job queue, meta inputs, and more. Live
+/// clients then follow `/api/dashboard/stream` (SSE) for incremental updates
+/// keyed off `seq`.
 // `StateSnapshot` is a large tree of nested view types (`ContainerView`,
-// `ApprovalView`, ...) with no `ToSchema` anywhere in that
+// `TransientView`, ...) with no `ToSchema` anywhere in that
 // graph; wiring it up is a schema-modelling project of its own, well past
 // "annotate what's reachable". `serde_json::Value` placeholder for now —
 // see the batch report.
@@ -252,19 +191,7 @@ pub(super) async fn api_state(
     let containers = state.coord.containers_snapshot().await;
     let any_stale = containers.iter().any(|c| c.needs_update);
     let transient_snapshot = state.coord.transient_snapshot();
-    let pending_approvals = approvals::gc_orphans(
-        &state.coord,
-        log_default("approvals.pending", state.coord.approvals.pending()),
-    );
     let transients = build_transient_views(&containers, &transient_snapshot);
-    let approvals = build_approval_views(pending_approvals);
-    let approval_history = log_default(
-        "approvals.recent_resolved",
-        state.coord.approvals.recent_resolved(30),
-    )
-    .into_iter()
-    .map(history_view)
-    .collect();
     let tombstones = build_tombstone_views(&state.coord, &containers);
     let port_conflicts = build_port_conflicts(&containers);
 
@@ -287,8 +214,6 @@ pub(super) async fn api_state(
         any_stale,
         containers,
         transients,
-        approvals,
-        approval_history,
         meta_inputs: read_meta_inputs(),
         meta_update_running: state.coord.meta_update_in_progress(),
         tombstones,
@@ -375,50 +300,6 @@ fn build_transient_views(
     out
 }
 
-/// Project a resolved sqlite row into the lean shape the dashboard
-/// history tab consumes — no `diff_html` (rendering 30 of them
-/// per /api/state poll would mean 30 git diffs per refresh).
-fn history_view(a: Approval) -> ApprovalHistoryView {
-    let displayed = a.commit_ref.as_str();
-    let sha_short = if displayed.is_empty() {
-        None
-    } else {
-        Some(displayed[..displayed.len().min(12)].to_owned())
-    };
-    let status = match a.status {
-        hive_sh4re::approvals::ApprovalStatus::Approved => "approved",
-        hive_sh4re::approvals::ApprovalStatus::Denied => "denied",
-        hive_sh4re::approvals::ApprovalStatus::Failed => "failed",
-        hive_sh4re::approvals::ApprovalStatus::Cancelled => "cancelled",
-        // Pending shouldn't appear in recent_resolved, but be defensive.
-        hive_sh4re::approvals::ApprovalStatus::Pending => "pending",
-    };
-    let kind = <&str>::from(a.kind);
-    ApprovalHistoryView {
-        id: a.id,
-        agent: a.agent.to_string(),
-        kind,
-        sha_short,
-        status,
-        resolved_at: a.resolved_at.unwrap_or_default(),
-        note: a.note,
-    }
-}
-
-fn build_approval_views(approvals: Vec<Approval>) -> Vec<ApprovalView> {
-    approvals
-        .into_iter()
-        .map(|a| ApprovalView {
-            id: a.id,
-            agent: a.agent.to_string(),
-            kind: <&str>::from(a.kind),
-            description: a.description,
-            commit_ref: a.commit_ref,
-            requested_at: a.requested_at,
-        })
-        .collect()
-}
-
 /// `/api/jobq/graph` query string — the generic jobq/wire query shape (any
 /// host serving a `GraphWire` projection over HTTP takes the same one; see
 /// `hive_jobq_wire::parse_states`, which does the actual parsing this side