build agents from internal/meta when it pins their config

A rebuild's MetaSync resolves the head of the swarm's internal/meta once and
records it; the prebuild and the swap build that flake instead of the hive's
own, and a first deploy does the same in Create. hive-priv takes the commit as
a validated meta_rev on UpdateContainer and CreateContainer and builds from its
own forge URL (HIVE_PRIV_FORGE_URL).

The head is used only when its flake lists the agent at the config commit the
forge's main is at; otherwise, and when the repo has no commit or this hive has
no core token file for nix's git, the hive renders locally as before.

hive-c0re's and hive-priv's gitconfig now share the forge credential helper and
rewrite the forge's https URLs to http, which hive-priv lacked.

hive-c0re/src/lifecycle/mod.rs

@@ -237,8 +237,10 @@ pub async fn provision_container(name: &str, hive: &HiveEnv, paths: &AgentPaths)
 
 /// The `nixos-container create` proper — the job queue's `Create` node.
 /// Assumes `provision_container` already registered the agent in meta.
-pub async fn create_only(name: &str) -> Result<()> {
-    priv_run("create", name).await
+/// `meta_rev` is the `internal/meta` commit to build from; none builds from the
+/// hive's own meta flake (`crate::meta_rev`).
+pub async fn create_only(name: &str, meta_rev: Option<&str>) -> Result<()> {
+    priv_run_inner("create", name, meta_rev, None).await
 }
 
 /// Rebuild-path preamble, run by the job queue's `Prebuild` node: fail fast on
@@ -290,15 +292,17 @@ pub async fn prepare_rebuild_dirs(name: &str, paths: &AgentPaths) -> Result<()>
 /// drop-ins, then `nixos-container update`. The job queue's `Swap`
 /// node. Requires the container stopped (the queue's `StopForUpdate`
 /// upstream); does NOT start it — the DAG's tail `Reconcile` owns
-/// bringing the agent back to its wanted power state.
+/// bringing the agent back to its wanted power state. `meta_rev` is as for
+/// [`create_only`].
 pub async fn swap_update(
     name: &str,
     hive: &HiveEnv,
     paths: &AgentPaths,
+    meta_rev: Option<&str>,
     node_id: Option<u64>,
 ) -> Result<()> {
     write_dropins(name, hive, paths).await?;
-    priv_run_inner("update", name, node_id).await
+    priv_run_inner("update", name, meta_rev, node_id).await
 }
 
 /// Build the `AgentSpec` list for the meta flake from `nixos-container
@@ -972,7 +976,7 @@ fn make_log_callback(
 /// is appended to the build-log row as it arrives, so the dashboard
 /// shows live progress during long `nixos-container create` / `update` runs.
 async fn priv_run(kind: &str, name: &str) -> Result<()> {
-    priv_run_inner(kind, name, None).await
+    priv_run_inner(kind, name, None, None).await
 }
 
 /// Like `priv_run` but stamps `node_id` onto the build-log row it opens, so
@@ -982,7 +986,12 @@ async fn priv_run(kind: &str, name: &str) -> Result<()> {
 /// This used to be a `Fn(i64)` callback that handed the row id *back* to the
 /// queue, which then held it in a side map. The row carries the link itself
 /// now, so the id only ever travels one way.
-async fn priv_run_inner(kind: &str, name: &str, node_id: Option<u64>) -> Result<()> {
+async fn priv_run_inner(
+    kind: &str,
+    name: &str,
+    meta_rev: Option<&str>,
+    node_id: Option<u64>,
+) -> Result<()> {
     let container = container_name(name);
     let cmdline = format!("nixos-container {kind} {container}");
 
@@ -1001,6 +1010,7 @@ async fn priv_run_inner(kind: &str, name: &str, node_id: Option<u64>) -> Result<
         "create" => {
             crate::priv_client::create_container_streaming(
                 name,
+                meta_rev,
                 make_log_callback(logs.clone(), log_id, cmdline.clone()),
             )
             .await
@@ -1008,6 +1018,7 @@ async fn priv_run_inner(kind: &str, name: &str, node_id: Option<u64>) -> Result<
         "update" => {
             crate::priv_client::update_container_streaming(
                 name,
+                meta_rev,
                 make_log_callback(logs.clone(), log_id, cmdline.clone()),
             )
             .await