hive-c0re: validate forge env at startup; char-safe short revs

HIVE_FORGE_URL (set + parseable) and HIVE_ASSETS_DIR are checked once in
main before workers start. Short revs in container_view and pr_status
take 12 chars instead of byte-slicing.

hive-c0re/src/forge/mod.rs

@@ -37,7 +37,8 @@ const FORGE_CONTAINER: &str = "hive-forge";
 ///
 /// # Panics
 ///
-/// When `HIVE_FORGE_URL` is unset. That is deliberate: this daemon only
+/// When `HIVE_FORGE_URL` is unset (`validate_env` rejects that at startup, so
+/// the daemon never reaches this). That is deliberate: this daemon only
 /// runs under the NixOS module, which always sets it, so an unset var
 /// means the deployment is broken. There is no loopback fallback,
 /// because a guess is wrong in exactly the cases that matter — the
@@ -55,6 +56,22 @@ pub(crate) fn forge_http_base() -> &'static str {
     })
 }
 
+/// Check the env the forge integration cannot run without: `HIVE_FORGE_URL`
+/// set and a valid URL, `HIVE_ASSETS_DIR` set. Called once from `main`
+/// before any worker is spawned, so a missing or malformed value fails the
+/// unit start naming the variable; the lazy accessors then never hit their
+/// `expect`s.
+pub(crate) fn validate_env() -> Result<()> {
+    let url = std::env::var("HIVE_FORGE_URL").context(
+        "HIVE_FORGE_URL is unset (the hyperhive NixOS module sets it on the hive-c0re unit)",
+    )?;
+    Url::parse(&url).with_context(|| format!("HIVE_FORGE_URL is not a valid URL: {url:?}"))?;
+    std::env::var("HIVE_ASSETS_DIR").context(
+        "HIVE_ASSETS_DIR is unset (the hyperhive NixOS module sets it on the hive-c0re unit)",
+    )?;
+    Ok(())
+}
+
 /// Git remote for `repo` (e.g. `"core/meta"`) — **credential-free**.
 ///
 /// The token does not go here. A URL is a process argument, and `argv` is