hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

hive-host-sock/README.md

@@ -15,8 +15,8 @@ thin dependency possible.
 ## Shape
 
 Serde-derived request/response enums for the host admin protocol. The larger
-shared payload types some variants reference (`Approval`, `AgentStatusRow`)
-stay in `hive-sh4re` — this crate is only the protocol envelope, no server or
+shared payload type some variants reference (`AgentStatusRow`) stays in
+`hive-sh4re` — this crate is only the protocol envelope, no server or
 client implementation.
 
 Its own `jobs` module is the exception: the job-queue vocabulary `hivectl`

hive-host-sock/src/lib.rs

@@ -6,13 +6,11 @@
 //! job-queue wire types ([`jobs`]) travel on this socket and the dashboard
 //! channels `hive-c0re` serves off the same snapshot, and on nothing else —
 //! their whole consumer set is `hive-c0re` + `hivectl` + this crate — so they
-//! live here rather than in the shared crate. The payload types genuinely
-//! shared with the *agent* sockets (`Approval`, `AgentStatusRow`) stay in
-//! `hive-sh4re`.
+//! live here rather than in the shared crate. The payload type genuinely
+//! shared with the *agent* sockets (`AgentStatusRow`) stays in `hive-sh4re`.
 
 use std::path::PathBuf;
 
-use hive_sh4re::approvals::Approval;
 use hive_sh4re::container::AgentStatusRow;
 use hive_types::Ident;
 use serde::{Deserialize, Serialize};
@@ -111,7 +109,7 @@ pub enum HostRequest {
     /// `Kill`.
     Kill { name: Ident },
     /// Tear down a sub-agent container, optionally purging state.
-    /// See `docs/agent-lifecycle/approvals.md::Destroy semantics`.
+    /// See `docs/agent-lifecycle/config-changes.md::Destroy semantics`.
     Destroy {
         name: Ident,
         #[serde(default)]
@@ -213,12 +211,6 @@ pub enum HostRequest {
     /// this request just answers whatever it's asked. Result:
     /// [`HostResponse::nodes`].
     QueueNodes { ids: Vec<u64> },
-    /// List pending approval requests.
-    Pending,
-    /// Approve a pending request by id; the action runs immediately.
-    Approve { id: i64 },
-    /// Deny a pending request by id.
-    Deny { id: i64 },
     /// Declare an agent's CPU/memory overrides for the per-container
     /// systemd drop-in, persisted to `meta/resource-limits.json`.
     ///
@@ -464,7 +456,7 @@ pub struct HiveUrls {
 /// client compares this against its own compiled-in copy of the constant
 /// and warns (does not fail the request) on mismatch — see
 /// `hivectl::client::version_mismatch_hint`, the one place that reads it.
-pub const HOST_SOCK_VERSION: u32 = 1;
+pub const HOST_SOCK_VERSION: u32 = 2;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct HostResponse {
@@ -483,8 +475,6 @@ pub struct HostResponse {
     pub error: Option<String>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub agents: Option<Vec<String>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub approvals: Option<Vec<Approval>>,
     /// `Urls` result — this hive's domain plus the browser-facing
     /// home / forge / matrix URLs. `None` for every other request kind.
     #[serde(default, skip_serializing_if = "Option::is_none")]
@@ -539,7 +529,6 @@ impl Default for HostResponse {
             ok: false,
             error: None,
             agents: None,
-            approvals: None,
             urls: None,
             agent_statuses: None,
             agent_exists: None,
@@ -578,15 +567,6 @@ impl HostResponse {
         }
     }
 
-    #[must_use]
-    pub fn pending(approvals: Vec<Approval>) -> Self {
-        Self {
-            ok: true,
-            approvals: Some(approvals),
-            ..Self::default()
-        }
-    }
-
     /// `Urls` result — this hive's domain + browser-facing web URLs.
     #[must_use]
     pub fn urls(urls: HiveUrls) -> Self {