hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

hive-c0re/src/job_queue/templates.rs

@@ -20,8 +20,6 @@
 //! `lifecycle::is_running` read), so [`super::power`] assembles them out of
 //! the primitives this module exports ([`rebuild_nodes`]).
 
-use hive_jobq::TerminalState;
-
 use super::model::{NodeKind, PermPayload};
 use super::resource::Resource;
 use super::{Handle, JobBuilder};
@@ -57,26 +55,6 @@ fn emit_rebuilt_tails(builder: &JobBuilder, agent: &str, roots: &[Handle<'_>]) {
     );
 }
 
-/// The approval-resolving tails for an approval-carrying DAG: one per outcome of
-/// the DAG's single group-root `root`, each accepting only its own.
-///
-/// The `Cancelled` node is what keeps a dropped approval DAG from dangling its
-/// row forever — its edge is the only one [`super::JobQueue::cancel`] spares.
-fn resolve_approval_tails(builder: &JobBuilder, approval_id: i64, root: Handle<'_>) {
-    for outcome in [
-        TerminalState::Done,
-        TerminalState::Failed,
-        TerminalState::Cancelled,
-    ] {
-        let _ = builder
-            .node(NodeKind::ResolveApproval {
-                approval_id,
-                outcome,
-            })
-            .on_outcome(root, &[outcome]);
-    }
-}
-
 /// Declare one rebuild subgraph per agent onto the builder a running
 /// [`NodeKind::MetaLock`] was handed.
 ///
@@ -349,9 +327,6 @@ pub fn rebuild(builder: &JobBuilder, agent: &str, relock: bool) -> Vec<hive_jobq
 /// borrow it. A failure cancel-cascades the rest — unlike rebuild there's no
 /// recovery-reconcile (nothing to converge if the container was never created).
 ///
-/// No approval tail: the operator authorised the creation at swarm level, and
-/// the deploy request carries that authorisation.
-///
 /// Returns the group root so a caller can wait on the whole subtree.
 pub fn first_deploy(builder: &JobBuilder, agent: &str) -> Vec<hive_jobq::NodeGuid> {
     let a = || agent.to_owned();
@@ -423,7 +398,7 @@ pub fn destroy(builder: &JobBuilder, agent: &str, purge: bool) {
         destroy
     };
     let _tail = builder
-        .node(NodeKind::DestroyBookkeeping { agent: a(), purge })
+        .node(NodeKind::DestroyBookkeeping { agent: a() })
         .part_of(stop)
         .after_ok(last);
 }
@@ -458,8 +433,8 @@ pub fn perm_change(builder: &JobBuilder, agent: &str, payload: PermPayload) {
 /// so the "hyperhive" pseudo-agent gets no pill), giving each cascade agent
 /// crash-watch suppression during its `Swap` — the property the old child
 /// `Rebuild` DAGs carried via their own transient.
-pub fn meta_update(builder: &JobBuilder, inputs: Vec<String>, approval_id: Option<i64>) {
-    let lock = builder
+pub fn meta_update(builder: &JobBuilder, inputs: Vec<String>) {
+    let _lock = builder
         .node(NodeKind::MetaLock {
             sweep: false,
             fanout: None,
@@ -467,14 +442,6 @@ pub fn meta_update(builder: &JobBuilder, inputs: Vec<String>, approval_id: Optio
         })
         .needs(Resource::BuildSlot)
         .needs(Resource::MetaWindow);
-    // The bump itself has no side effect, so an operator-driven one ends
-    // at the `MetaLock`; an approval-driven one still has its row to
-    // resolve and gets the per-outcome tails edged onto that single
-    // group-root — whose roll-up covers the rebuild subgraphs `MetaLock`
-    // grows into itself.
-    if let Some(approval_id) = approval_id {
-        resolve_approval_tails(builder, approval_id, lock);
-    }
 }
 
 // The boot is assembled inline in `workers/auto_update.rs::submit_boot_tree`