grant manage_root_agent by stored permission only, not by the name ruth

Permission::default_for and hive-sh4re's MANAGER_AGENT are gone: every
agent with no permissions key holds Permission::DEFAULT, ruth included.
The agent-name parameters that only fed default_for go with it
(permissions::effective, HiveCopy::before_read/after_read and their
callers).

swarm-controller seeds the grant ruth held by name: at start, a declared
ruth whose permissions are unset gets DEFAULT plus manage_root_agent
written into her key, once, logged. A set key is never touched. It is a
one-shot to delete once every swarm has passed it.

The swarm UI setup assistant opens the create form with
manage_root_agent checked, so a new ruth is created with the grant.
permissions_import no longer adds ruth to the import or splits her
default. Docs and help text no longer say ruth holds the grant by
default; swarmctl-cli.md regenerated.

hive-c0re/src/agent_config/permissions.rs

@@ -6,7 +6,7 @@
 //! Format: agent name → the stored
 //! [`swarm_queue_client::agent_permissions::AgentPermissions`]. An agent with
 //! no entry, or an entry with `permissions` unset, holds
-//! [`Permission::default_for`]; `"permissions": []` holds none.
+//! [`Permission::DEFAULT`]; `"permissions": []` holds none.
 //!
 //! hive-c0re enforces one member, [`Permission::ManageRootAgent`]: read by
 //! `lifecycle::host_config::set_nspawn_flags` on every container start, which
@@ -40,12 +40,12 @@ pub fn write_at(path: &Path, stored: &Stored) -> std::io::Result<()> {
     super::write_map(path, stored)
 }
 
-/// The permissions `agent` holds under `record`.
+/// The permissions an agent holds under `record`.
 #[must_use]
-pub fn effective(agent: &str, record: Option<&AgentPermissions>) -> Vec<Permission> {
+pub fn effective(record: Option<&AgentPermissions>) -> Vec<Permission> {
     record
         .and_then(|r| r.permissions.clone())
-        .unwrap_or_else(|| Permission::default_for(agent))
+        .unwrap_or_else(|| Permission::DEFAULT.to_vec())
 }
 
 /// Whether `agent` holds `perm` per the file at `path` (normally [`path`]).
@@ -54,7 +54,7 @@ pub fn effective(agent: &str, record: Option<&AgentPermissions>) -> Vec<Permissi
 ///
 /// As [`read_at`].
 pub fn holds(path: &Path, agent: &str, perm: Permission) -> std::io::Result<bool> {
-    Ok(effective(agent, read_at(path)?.get(agent)).contains(&perm))
+    Ok(effective(read_at(path)?.get(agent)).contains(&perm))
 }
 
 /// Write `agent`'s [`HiveCopy`] into `runtime_dir`: its entry in the file at
@@ -91,25 +91,41 @@ mod tests {
 
     #[test]
     fn unset_is_the_default_and_an_empty_list_is_none() {
-        assert!(effective("ruth", None).contains(&Permission::ManageRootAgent));
-        assert!(effective("ruth", Some(&record("{}"))).contains(&Permission::ManageRootAgent));
-        assert!(effective("ruth", Some(&record(r#"{"permissions":[]}"#))).is_empty());
-        assert_eq!(effective("atlas", None), Permission::DEFAULT.to_vec());
+        assert_eq!(effective(None), Permission::DEFAULT.to_vec());
+        assert_eq!(effective(Some(&record("{}"))), Permission::DEFAULT.to_vec());
+        assert!(effective(Some(&record(r#"{"permissions":[]}"#))).is_empty());
         assert_eq!(
-            effective(
-                "atlas",
-                Some(&record(r#"{"permissions":["manage_root_agent"]}"#))
-            ),
+            effective(Some(&record(r#"{"permissions":["manage_root_agent"]}"#))),
             vec![Permission::ManageRootAgent]
         );
     }
 
+    /// No name holds more than the default without an entry: `ruth` with no
+    /// entry holds `DEFAULT`, and only an entry grants her `manage_root_agent`.
     #[test]
-    fn a_missing_file_holds_the_defaults() {
+    fn ruth_with_no_entry_holds_the_default() {
         let dir = tempfile::tempdir().expect("tempdir");
         let path = dir.path().join(FILE);
-        assert!(holds(&path, "ruth", Permission::ManageRootAgent).expect("missing is empty"));
-        assert!(!holds(&path, "atlas", Permission::ManageRootAgent).expect("missing is empty"));
+        for agent in ["ruth", "atlas"] {
+            for perm in Permission::ALL {
+                assert_eq!(
+                    holds(&path, agent, *perm).expect("missing is empty"),
+                    Permission::DEFAULT.contains(perm),
+                    "{agent} {perm:?}"
+                );
+            }
+        }
+
+        write_at(
+            &path,
+            &Stored::from([(
+                "ruth".to_owned(),
+                record(r#"{"permissions":["manage_root_agent"]}"#),
+            )]),
+        )
+        .expect("seed");
+        assert!(holds(&path, "ruth", Permission::ManageRootAgent).expect("read"));
+        assert!(!holds(&path, "atlas", Permission::ManageRootAgent).expect("read"));
     }
 
     /// With the queue down nothing is read, so the agent starts on the copy
@@ -131,7 +147,7 @@ mod tests {
         hand_at(&stored, true, "atlas", &runtime).expect("hand");
         let copy = HiveCopy::read_at(&runtime.join(HIVE_COPY_FILE));
         assert!(copy.import_pending);
-        assert_eq!(copy.before_read("atlas"), vec![Permission::WebTools]);
+        assert_eq!(copy.before_read(), vec![Permission::WebTools]);
 
         hand_at(&stored, false, "iris", &runtime).expect("hand");
         let copy = HiveCopy::read_at(&runtime.join(HIVE_COPY_FILE));