build agents from internal/meta when it pins their config

A rebuild's MetaSync resolves the head of the swarm's internal/meta once and
records it; the prebuild and the swap build that flake instead of the hive's
own, and a first deploy does the same in Create. hive-priv takes the commit as
a validated meta_rev on UpdateContainer and CreateContainer and builds from its
own forge URL (HIVE_PRIV_FORGE_URL).

The head is used only when its flake lists the agent at the config commit the
forge's main is at; otherwise, and when the repo has no commit or this hive has
no core token file for nix's git, the hive renders locally as before.

hive-c0re's and hive-priv's gitconfig now share the forge credential helper and
rewrite the forge's https URLs to http, which hive-priv lacked.

hive-priv/src/main.rs

@@ -349,12 +349,22 @@ async fn exec(
 
         PrivRequest::KillContainer { ref name } => container::kill_container(name).await,
 
-        PrivRequest::UpdateContainer { ref name, stream } => {
-            container::container_flake_action("update", name, stream, writer).await
+        PrivRequest::UpdateContainer {
+            ref name,
+            stream,
+            ref meta_rev,
+        } => {
+            container::container_flake_action("update", name, meta_rev.as_deref(), stream, writer)
+                .await
         }
 
-        PrivRequest::CreateContainer { ref name, stream } => {
-            container::container_flake_action("create", name, stream, writer).await
+        PrivRequest::CreateContainer {
+            ref name,
+            stream,
+            ref meta_rev,
+        } => {
+            container::container_flake_action("create", name, meta_rev.as_deref(), stream, writer)
+                .await
         }
 
         PrivRequest::DestroyContainer { ref name } => container::destroy_container(name).await,