grant manage_root_agent by stored permission only, not by the name ruth

Permission::default_for and hive-sh4re's MANAGER_AGENT are gone: every
agent with no permissions key holds Permission::DEFAULT, ruth included.
The agent-name parameters that only fed default_for go with it
(permissions::effective, HiveCopy::before_read/after_read and their
callers).

swarm-controller seeds the grant ruth held by name: at start, a declared
ruth whose permissions are unset gets DEFAULT plus manage_root_agent
written into her key, once, logged. A set key is never touched. It is a
one-shot to delete once every swarm has passed it.

The swarm UI setup assistant opens the create form with
manage_root_agent checked, so a new ruth is created with the grant.
permissions_import no longer adds ruth to the import or splits her
default. Docs and help text no longer say ruth holds the grant by
default; swarmctl-cli.md regenerated.

frontend/packages/swarm-ui/src/pages/CreateAgentPermissions.ts

@@ -22,3 +22,19 @@ export function requestPermissions(
     selected.every((p) => defaults.includes(p));
   return same ? undefined : selected;
 }
+
+/**
+ * The form's starting selection: `defaults` plus each of `extra` the
+ * catalogue lists (`all`), so a name the controller does not know is not
+ * sent.
+ */
+export function initialSelection(
+  all: string[],
+  defaults: string[],
+  extra: string[],
+): string[] {
+  return [
+    ...defaults,
+    ...extra.filter((p) => all.includes(p) && !defaults.includes(p)),
+  ];
+}