grant manage_root_agent by stored permission only, not by the name ruth

Permission::default_for and hive-sh4re's MANAGER_AGENT are gone: every
agent with no permissions key holds Permission::DEFAULT, ruth included.
The agent-name parameters that only fed default_for go with it
(permissions::effective, HiveCopy::before_read/after_read and their
callers).

swarm-controller seeds the grant ruth held by name: at start, a declared
ruth whose permissions are unset gets DEFAULT plus manage_root_agent
written into her key, once, logged. A set key is never touched. It is a
one-shot to delete once every swarm has passed it.

The swarm UI setup assistant opens the create form with
manage_root_agent checked, so a new ruth is created with the grant.
permissions_import no longer adds ruth to the import or splits her
default. Docs and help text no longer say ruth holds the grant by
default; swarmctl-cli.md regenerated.

frontend/packages/swarm-ui/test/create-agent-permissions.test.mjs

@@ -3,6 +3,7 @@
 import assert from "node:assert/strict";
 import { test } from "node:test";
 import {
+  initialSelection,
   requestPermissions,
   togglePermission,
 } from "../src/pages/CreateAgentPermissions.ts";
@@ -29,3 +30,17 @@ test("a changed set is sent, an empty one included", () => {
     "web_tools",
   ]);
 });
+
+const all = [...defaults, "web_tools", "manage_root_agent"];
+
+test("the starting selection is the default plus the known extras", () => {
+  assert.deepEqual(initialSelection(all, defaults, []), defaults);
+  assert.deepEqual(initialSelection(all, defaults, ["manage_root_agent"]), [
+    ...defaults,
+    "manage_root_agent",
+  ]);
+  assert.deepEqual(
+    initialSelection(all, defaults, ["meta", "fly_to_the_moon"]),
+    defaults,
+  );
+});

frontend/packages/swarm-ui/test/ruth-missing.test.mjs

@@ -1,7 +1,15 @@
-// The setup assistant's "is ruth missing" check. Run by `npm test`.
+// The setup assistant: its "is ruth missing" check and the permissions it
+// creates her with. Run by `npm test`.
 import assert from "node:assert/strict";
 import { test } from "node:test";
-import { ruthIsMissing } from "../src/shell/ruth-missing.ts";
+import {
+  RUTH_EXTRA_PERMISSIONS,
+  ruthIsMissing,
+} from "../src/shell/ruth-missing.ts";
+import {
+  initialSelection,
+  requestPermissions,
+} from "../src/pages/CreateAgentPermissions.ts";
 
 const answering =
   (body, ok = true) =>
@@ -35,3 +43,21 @@ test("anything but a clear answer is not missing", async () => {
     false,
   );
 });
+
+// The assistant's create form sends `manage_root_agent` with the default
+// set, so a new ruth holds it from her first start; the default alone does not.
+test("the assistant creates ruth with manage_root_agent", () => {
+  const defaults = ["messaging", "meta", "inbox", "execution"];
+  const all = [...defaults, "web_tools", "manage_root_agent"];
+  assert.deepEqual(
+    requestPermissions(
+      initialSelection(all, defaults, RUTH_EXTRA_PERMISSIONS),
+      defaults,
+    ),
+    [...defaults, "manage_root_agent"],
+  );
+  assert.equal(
+    requestPermissions(initialSelection(all, defaults, []), defaults),
+    undefined,
+  );
+});