build agents from internal/meta when it pins their config

A rebuild's MetaSync resolves the head of the swarm's internal/meta once and
records it; the prebuild and the swap build that flake instead of the hive's
own, and a first deploy does the same in Create. hive-priv takes the commit as
a validated meta_rev on UpdateContainer and CreateContainer and builds from its
own forge URL (HIVE_PRIV_FORGE_URL).

The head is used only when its flake lists the agent at the config commit the
forge's main is at; otherwise, and when the repo has no commit or this hive has
no core token file for nix's git, the hive renders locally as before.

hive-c0re's and hive-priv's gitconfig now share the forge credential helper and
rewrite the forge's https URLs to http, which hive-priv lacked.

hive-c0re/src/forge/reader.rs

@@ -34,6 +34,11 @@ impl ReaderToken {
     pub fn auth_header(&self) -> String {
         basic_auth_header(&self.login, &self.value)
     }
+
+    /// A forge API client acting as this token's account.
+    pub(crate) fn api(&self) -> anyhow::Result<forgejo_api::Forgejo> {
+        super::api(&self.value)
+    }
 }
 
 /// The token to read the forge with, or `None` when this hive has neither.