build agents from internal/meta when it pins their config

A rebuild's MetaSync resolves the head of the swarm's internal/meta once and
records it; the prebuild and the swap build that flake instead of the hive's
own, and a first deploy does the same in Create. hive-priv takes the commit as
a validated meta_rev on UpdateContainer and CreateContainer and builds from its
own forge URL (HIVE_PRIV_FORGE_URL).

The head is used only when its flake lists the agent at the config commit the
forge's main is at; otherwise, and when the repo has no commit or this hive has
no core token file for nix's git, the hive renders locally as before.

hive-c0re's and hive-priv's gitconfig now share the forge credential helper and
rewrite the forge's https URLs to http, which hive-priv lacked.

docs/integrations/forge.md

@@ -80,6 +80,12 @@ forge container:
 - seeding `proposed` from `agent-configs/<agent>` on first deploy
 - cloning and pulling `/knowledge`
 
+The builds themselves read as `core`. nix fetches the config inputs and
+`internal/meta` with `git`, and `git` gets its credential from
+`git-credential-hive-forge`, which reads the `core` token file. A hive without
+that file fetches nothing private through nix, whatever its own token reads, so
+it builds from its own meta flake rather than `internal/meta`.
+
 Roll a change to any of this out store host first (its granter writes the
 controller's grant on `swarm/hives/+/forge/token`), then the controller host,
 then the hives. A hive that starts before its token exists reads with the