grant manage_root_agent by stored permission only, not by the name ruth

Permission::default_for and hive-sh4re's MANAGER_AGENT are gone: every
agent with no permissions key holds Permission::DEFAULT, ruth included.
The agent-name parameters that only fed default_for go with it
(permissions::effective, HiveCopy::before_read/after_read and their
callers).

swarm-controller seeds the grant ruth held by name: at start, a declared
ruth whose permissions are unset gets DEFAULT plus manage_root_agent
written into her key, once, logged. A set key is never touched. It is a
one-shot to delete once every swarm has passed it.

The swarm UI setup assistant opens the create form with
manage_root_agent checked, so a new ruth is created with the grant.
permissions_import no longer adds ruth to the import or splits her
default. Docs and help text no longer say ruth holds the grant by
default; swarmctl-cli.md regenerated.

frontend/packages/swarm-ui/test/create-agent-permissions.test.mjs

@@ -3,6 +3,7 @@
 import assert from "node:assert/strict";
 import { test } from "node:test";
 import {
+  initialSelection,
   requestPermissions,
   togglePermission,
 } from "../src/pages/CreateAgentPermissions.ts";
@@ -29,3 +30,17 @@ test("a changed set is sent, an empty one included", () => {
     "web_tools",
   ]);
 });
+
+const all = [...defaults, "web_tools", "manage_root_agent"];
+
+test("the starting selection is the default plus the known extras", () => {
+  assert.deepEqual(initialSelection(all, defaults, []), defaults);
+  assert.deepEqual(initialSelection(all, defaults, ["manage_root_agent"]), [
+    ...defaults,
+    "manage_root_agent",
+  ]);
+  assert.deepEqual(
+    initialSelection(all, defaults, ["meta", "fly_to_the_moon"]),
+    defaults,
+  );
+});