grant manage_root_agent by stored permission only, not by the name ruth

Permission::default_for and hive-sh4re's MANAGER_AGENT are gone: every
agent with no permissions key holds Permission::DEFAULT, ruth included.
The agent-name parameters that only fed default_for go with it
(permissions::effective, HiveCopy::before_read/after_read and their
callers).

swarm-controller seeds the grant ruth held by name: at start, a declared
ruth whose permissions are unset gets DEFAULT plus manage_root_agent
written into her key, once, logged. A set key is never touched. It is a
one-shot to delete once every swarm has passed it.

The swarm UI setup assistant opens the create form with
manage_root_agent checked, so a new ruth is created with the grant.
permissions_import no longer adds ruth to the import or splits her
default. Docs and help text no longer say ruth holds the grant by
default; swarmctl-cli.md regenerated.

hive-c0re/src/coordinator.rs

@@ -866,11 +866,10 @@ impl Coordinator {
     /// --continue's session). Best-effort; broker errors are logged
     /// but don't propagate.
     pub fn kick_agent(&self, name: &str, reason: &str) {
-        // Sub-agents bind their state at /agents/<name>/state. The
-        // manager has both /state (legacy mount) and /agents
-        // bind-mounted, so /agents/<name>/state resolves there too —
-        // use that uniformly so the wake message has one canonical
-        // path that works everywhere.
+        // Every agent binds its state at /agents/<name>/state, and a
+        // `manage_root_agent` holder has all of /agents bind-mounted, so
+        // the path resolves there too — use that uniformly so the wake
+        // message has one canonical path that works everywhere.
         let body = format!(
             "{reason}\n\nYou were just (re)started by the operator. \
              If you were mid-task, check `/agents/{name}/state/` for \