hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

hive-c0re/src/workers/auto_update.rs

@@ -113,8 +113,8 @@ fn plan_root_agent(list_result: anyhow::Result<Vec<String>>) -> RootAgentPlan {
 
 /// Auto-create the manager container on startup if it isn't already there.
 /// hive-c0re manages the manager end-to-end: operators no longer declare
-/// `containers.h-ruth` in their host NixOS config. Bypasses the approval
-/// queue — the root/manager is auto-managed by default. Operators who
+/// `containers.h-ruth` in their host NixOS config. The root/manager is
+/// auto-managed by default. Operators who
 /// don't want a root agent at all set `services.hyperhive.ruthless = true`,
 /// which short-circuits this whole function. Idempotent.
 pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {

hive-c0re/src/workers/crash_watch.rs

@@ -1,7 +1,7 @@
 //! Per-container crash and login-state watcher. Polls every managed
 //! container on a 10s interval. Fires `ContainerCrash`, `LoggedIn`,
 //! and `NeedsLogin` helper events. Event semantics and the
-//! `RECENT_TRANSIENT_GRACE` window: `docs/agent-lifecycle/approvals.md::Helper events`.
+//! `RECENT_TRANSIENT_GRACE` window: `docs/agent-lifecycle/config-changes.md::Helper events`.
 
 use std::collections::HashSet;
 use std::sync::Arc;