hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

hive-sh4re/src/inbox.rs

@@ -117,6 +117,17 @@ pub enum ReminderTiming {
     At { unix_timestamp: i64 },
 }
 
+/// Reminder activity statistics for an agent over a time window.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReminderStats {
+    /// Total reminders scheduled in the window (`created_at` >= cutoff).
+    pub scheduled: u64,
+    /// Reminders that have been delivered in the window (`sent_at` IS NOT NULL).
+    pub delivered: u64,
+    /// Reminders still pending in the window (`sent_at` IS NULL).
+    pub pending: u64,
+}
+
 /// One row in the response to `GetLooseEnds`. Tagged enum so new
 /// thread kinds can land without breaking existing handlers.
 /// Per-flavour scoping + per-variant fields + clock-anomaly
@@ -125,15 +136,6 @@ pub enum ReminderTiming {
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(tag = "kind", rename_all = "snake_case")]
 pub enum LooseEnd {
-    /// A pending approval row.
-    Approval {
-        id: i64,
-        agent: String,
-        commit_ref: String,
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        description: Option<String>,
-        age_seconds: u64,
-    },
     /// A scheduled but un-delivered reminder row.
     Reminder {
         id: i64,
@@ -190,9 +192,8 @@ pub enum LooseEnd {
 
 /// Age in seconds between two unix timestamps, clamped to 0 when `then`
 /// is in the future. This is what backs the `age_seconds` promise on
-/// every [`LooseEnd`] variant above, so it lives beside the enum rather
-/// than in either producer: hive-c0re derives approval ages here, and
-/// hive-agent's in-agent socket server derives reminder + todo ages.
+/// every [`LooseEnd`] variant above, so it lives beside the enum;
+/// hive-agent's in-agent socket server derives reminder + todo ages with it.
 ///
 /// Both clamps are load-bearing and neither substitutes for the other:
 /// `saturating_sub` keeps the subtraction itself from overflowing on
@@ -205,17 +206,6 @@ pub fn saturating_age(now: i64, then: i64) -> u64 {
     u64::try_from(delta).unwrap_or(0)
 }
 
-/// Kind discriminator for `CancelLooseEnd`. Per-kind store +
-/// authorisation rules live in
-/// `docs/process/conventions.md::Loose-ends wire shape`.
-#[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
-#[serde(rename_all = "snake_case")]
-pub enum CancelLooseEndKind {
-    Reminder,
-    /// Withdraw a pending approval (manager surface only).
-    Approval,
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;