hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

hive-core-agent-sock/src/lib.rs

@@ -4,11 +4,11 @@
 //! in-container harness (and the manager) and the `hive-c0re` daemon over the
 //! per-agent mcp socket. Re-homed out of `hive-sh4re` so this one socket owns
 //! its own protocol crate, mirroring `hive-host-sock` / `hive-priv-sock`. The
-//! shared payload types it references (`Message`, `LooseEnd`, `Approval`, …)
+//! shared payload types it references (`Message`, `LooseEnd`, …)
 //! stay in `hive-sh4re`, which this crate depends on.
 
 use hive_sh4re::container::MatrixIdentity;
-use hive_sh4re::inbox::{CancelLooseEndKind, DeliveredMessage, InboxRow, LooseEnd};
+use hive_sh4re::inbox::{DeliveredMessage, InboxRow, LooseEnd};
 use hive_types::Ident;
 use serde::{Deserialize, Serialize};
 
@@ -76,10 +76,6 @@ pub enum Request {
         #[serde(default, skip_serializing_if = "Option::is_none")]
         name: Option<Ident>,
     },
-    /// Cancel an open thread the agent owns. Authorisation +
-    /// per-kind semantics in
-    /// `docs/process/conventions.md::Loose-ends wire shape`.
-    CancelLooseEnd { kind: CancelLooseEndKind, id: i64 },
     /// Mark every message popped since the last `AckTurn` as handled.
     /// Harness↔broker pairing fired after `TurnOutcome::Ok`. See
     /// `docs/process/conventions.md::Broker delivery + ack cycle`.