hive-c0re: remove the approvals subsystem

Nothing submits an approval since scheduled prompts left hive-c0re, so the
queue only acted on rows written before that.

- hive-c0re: the approvals store and its migrations, approve/deny/
  resolve actions, the ResolveApproval tail node (and meta_update's
  approval_id), POST /api/approve and /api/deny, the approval views on
  /api/state, the approval_resolved dashboard event, the orphan GC,
  destroy/purge failing pending rows, and the approval rows in
  get_loose_ends. DestroyBookkeeping loses the purge flag, which only
  worded the approval-failure note.
- The CancelLooseEnd request goes: its only hive-c0re arm was the
  approval one. cancel_loose_end handles reminder and todo in the harness.
- Wire types: hive_sh4re::approvals (ReminderStats moves to inbox),
  LooseEnd::Approval, CancelLooseEndKind, HelperEvent::ApprovalResolved,
  ToolGroup::Approvals, HostRequest::{Pending,Approve,Deny} and
  HostResponse.approvals. HOST_SOCK_VERSION goes to 2 for the removed
  field.
- hivectl loses the approvals verbs; docs/tools/hivectl-cli.md is
  regenerated.
- The system prompt drops approval_resolved.
- The approvals table stays in broker.sqlite, unread, the same way the
  operator_questions table was left when its store was removed.
- An `approvals` entry still in tool-groups.json is skipped with a warning
  by ToolGroup::parse_list, like any unknown group.
- docs/agent-lifecycle/approvals.md is renamed to config-changes.md so the
  code's doc pointers resolve; its content follows in the docs commit.

hivectl/src/approvals.rs

@@ -1,24 +0,0 @@
-//! `hivectl approvals` — the operator approval queue (pending/approve/deny).
-
-use std::path::Path;
-
-use anyhow::Result;
-use hive_host_sock::HostRequest;
-
-use crate::cli::ApprovalsCmd;
-use crate::util::render;
-
-/// Dispatch `hivectl approvals <verb>` — the operator approval queue.
-pub(crate) async fn run_approvals(socket: &Path, cmd: ApprovalsCmd) -> Result<()> {
-    match cmd {
-        ApprovalsCmd::Pending => {
-            render(crate::client::request(socket, HostRequest::Pending).await?)
-        }
-        ApprovalsCmd::Approve { id } => {
-            render(crate::client::request(socket, HostRequest::Approve { id }).await?)
-        }
-        ApprovalsCmd::Deny { id } => {
-            render(crate::client::request(socket, HostRequest::Deny { id }).await?)
-        }
-    }
-}

hivectl/src/cli.rs

@@ -82,13 +82,6 @@ pub enum Cmd {
     /// under `hivectl agent <name>`. Idempotent — safe to re-run. Once
     /// enabled, `hivectl agent <name> quota show`/`quota set` work.
     QuotaEnable,
-    /// Operator approval queue: list, approve, or deny pending requests.
-    ///
-    /// Needs the hive-c0re daemon running.
-    Approvals {
-        #[command(subcommand)]
-        cmd: ApprovalsCmd,
-    },
     /// WireGuard inter-hive mesh setup helpers.
     ///
     /// Generate this hive's mesh key and print the nix to enable the mesh,
@@ -476,23 +469,6 @@ pub enum AgentQuotaCmd {
     },
 }
 
-/// Operator approval queue: list, approve, or deny pending requests.
-#[derive(Subcommand)]
-pub enum ApprovalsCmd {
-    /// List pending approval requests submitted by agents.
-    Pending,
-    /// Approve a pending request by id; the action runs immediately.
-    Approve {
-        /// Approval id (from `hivectl approvals pending`).
-        id: i64,
-    },
-    /// Deny a pending request by id.
-    Deny {
-        /// Approval id.
-        id: i64,
-    },
-}
-
 #[derive(Subcommand)]
 pub enum SubvolCmd {
     /// Convert a plain-dir agent state root into a btrfs subvolume in

hivectl/src/main.rs

@@ -2,9 +2,8 @@
 //!
 //! A thin client for the `hive-c0re` daemon: it speaks the host admin
 //! socket protocol (`hive-host-sock`) and does NOT link the daemon crate.
-//! Container lifecycle + the approval queue (`agent <name> <spawn|kill|
-//! rebuild|restart|choom|…>`, `list-agents`, `approvals <pending|approve|
-//! deny>`, `stop` / `start`) and provisioning (`forge` / `matrix` /
+//! Container lifecycle (`agent <name> <spawn|kill|rebuild|restart|choom|…>`,
+//! `list-agents`, `stop` / `start`) and provisioning (`forge` / `matrix` /
 //! `gateway`) all forward to the daemon, which owns the broker,
 //! the credentials, and the provisioning logic — a running daemon is
 //! required for those. A couple of verbs work off local host state
@@ -48,9 +47,7 @@ mod agents;
 use agents::{agents_list, run_agent};
 mod power;
 use power::{restart, start, stop};
-mod approvals;
 mod subvol;
-use approvals::run_approvals;
 
 #[tokio::main]
 async fn main() -> Result<()> {
@@ -83,7 +80,6 @@ async fn main() -> Result<()> {
         Cmd::Agent { name, cmd } => run_agent(&socket, &name, cmd).await,
         Cmd::ListAgents { json } => agents_list(&socket, json).await,
         Cmd::QuotaEnable => quota::quota_enable(&socket).await,
-        Cmd::Approvals { cmd } => run_approvals(&socket, cmd).await,
         Cmd::Wg { cmd } => match cmd {
             WgCmd::Init { address } => wg_init(&socket, address.as_deref()).await,
             WgCmd::Peer {

hivectl/src/util.rs

@@ -70,7 +70,7 @@ pub(crate) fn resolve_password(
 }
 
 /// Pretty-print a `HostResponse` as JSON and bail on failure. Used by the
-/// agent-lifecycle + approval verbs that just relay a daemon result verbatim.
+/// agent-lifecycle verbs that just relay a daemon result verbatim.
 pub(crate) fn render(resp: hive_host_sock::HostResponse) -> Result<()> {
     println!("{}", serde_json::to_string_pretty(&resp)?);
     if !resp.ok {