build agents from internal/meta when it pins their config

A rebuild's MetaSync resolves the head of the swarm's internal/meta once and
records it; the prebuild and the swap build that flake instead of the hive's
own, and a first deploy does the same in Create. hive-priv takes the commit as
a validated meta_rev on UpdateContainer and CreateContainer and builds from its
own forge URL (HIVE_PRIV_FORGE_URL).

The head is used only when its flake lists the agent at the config commit the
forge's main is at; otherwise, and when the repo has no commit or this hive has
no core token file for nix's git, the hive renders locally as before.

hive-c0re's and hive-priv's gitconfig now share the forge credential helper and
rewrite the forge's https URLs to http, which hive-priv lacked.

nix/host-modules/lib/hive-forge-git.nix

@@ -0,0 +1,44 @@
+# Git settings for the host processes that hand nix a forge URL: hive-c0re
+# (prebuilds as `hive-core`) and hive-priv (builds as root, with a HOME of its
+# own), each through its own `$HOME/.gitconfig`. nix runs `git` for a `git+…`
+# input, so git's config is the only credential and URL plumbing it has.
+#
+# - `credential`: the forge host answers through `git-credential-hive-forge`,
+#   which reads the live `core` token file. An empty `helper =` first resets the
+#   list, so no /etc/gitconfig helper (e.g. `oauth`, which waits on a browser)
+#   runs ahead of ours.
+# - `url`: the swarm's `internal/meta` lock names its inputs by the forge's
+#   `https` URL, which only the builder's credential helper answers for. They
+#   are fetched over the `http` URL the helper above is scoped to.
+#
+# Pure function — NOT a NixOS module (don't add it to the host-modules
+# aggregator). Call it from a module's `let`:
+#
+#   forgeGit = import ./lib/hive-forge-git.nix { inherit pkgs; forgeDomain = …; };
+#   # then put `forgeGit.credentialHelper` on the unit's `path` and
+#   # `forgeGit.config` into its gitconfig.
+{ pkgs, forgeDomain }:
+{
+  # Answers only `get`, for the forge `core` user, from the live token file
+  # (`/var/lib/hyperhive/forge-core-token`, hive-c0re's `paths::FORGE_CORE_TOKEN`)
+  # on every invocation, so it never holds a stale copy and survives token
+  # rotation; prints nothing where the file is absent.
+  credentialHelper = pkgs.writeShellScriptBin "git-credential-hive-forge" ''
+    [ "''${1:-}" = "get" ] || exit 0
+    if [ -r /var/lib/hyperhive/forge-core-token ]; then
+      printf 'username=core\n'
+      printf 'password=%s\n' "$(cat /var/lib/hyperhive/forge-core-token)"
+    fi
+  '';
+
+  config = ''
+    [credential]
+    helper =
+    [credential "http://${forgeDomain}"]
+    helper =
+    helper = hive-forge
+    username = core
+    [url "http://${forgeDomain}/"]
+    insteadOf = https://${forgeDomain}/
+  '';
+}