hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

hive-c0re/src/dashboard_events.rs

@@ -48,25 +48,6 @@ pub enum DashboardEvent {
         #[serde(default, skip_serializing_if = "Vec::is_empty")]
         file_refs: Vec<String>,
     },
-    /// A pending approval transitioned to a terminal state
-    /// (approved / denied / failed). Clients move the row out of the
-    /// pending list and into history.
-    ///
-    /// The approval's own kind (`"update_meta_inputs"`) lives
-    /// on `approval_kind` rather than `kind` because the latter is taken
-    /// by the serde tag identifying which `DashboardEvent` variant
-    /// this is.
-    ApprovalResolved {
-        seq: u64,
-        id: i64,
-        agent: String,
-        approval_kind: &'static str,
-        /// `"approved"` / `"denied"` / `"failed"`.
-        status: &'static str,
-        resolved_at: DateTime<Utc>,
-        note: Option<String>,
-        description: Option<String>,
-    },
     /// A lifecycle action started for an agent (spawn / start / stop
     /// / restart / rebuild / destroy). Clients render a spinner next
     /// to the row; the client computes "seconds in this state"
@@ -109,7 +90,7 @@ pub enum DashboardEvent {
     /// Fired by `Coordinator::rescan_containers_and_emit`, which diffs
     /// a fresh `nixos-container list`–derived snapshot against the
     /// last one cached on the coordinator. Mutation sites (lifecycle
-    /// endpoints, `actions::destroy` / approve, `crash_watch`'s poll loop)
+    /// endpoints, `actions::destroy`, `crash_watch`'s poll loop)
     /// call the rescan after their work lands.
     ContainerStateChanged { seq: u64, container: ContainerView },
     /// A container that was in the previous snapshot is gone. Clients
@@ -157,7 +138,7 @@ pub enum DashboardEvent {
     ///
     /// Kept as an event rather than deleted in favour of polling because
     /// push-on-change is what every other live surface here does
-    /// (transients, container state, approvals), and a poll loop would be
+    /// (transients, container state), and a poll loop would be
     /// slower for the same information.
     RebuildQueueChanged { seq: u64 },
     /// Full snapshot of capability grants (per-agent `Vec<cap_name>`).
@@ -214,7 +195,6 @@ impl DashboardEvent {
         match self {
             DashboardEvent::Sent { .. } => "sent",
             DashboardEvent::Delivered { .. } => "delivered",
-            DashboardEvent::ApprovalResolved { .. } => "approval_resolved",
             DashboardEvent::TransientSet { .. } => "transient_set",
             DashboardEvent::TransientCleared { .. } => "transient_cleared",
             DashboardEvent::ContainerStateChanged { .. } => "container_state_changed",
@@ -271,16 +251,6 @@ mod tests {
                 in_reply_to: None,
                 file_refs: Vec::new(),
             },
-            DashboardEvent::ApprovalResolved {
-                seq: 1,
-                id: 1,
-                agent: "x".into(),
-                approval_kind: "update_meta_inputs",
-                status: "approved",
-                resolved_at: hive_sh4re::wire_time::from_secs(0),
-                note: None,
-                description: None,
-            },
             DashboardEvent::TransientSet {
                 seq: 1,
                 name: "x".into(),