remove the create_repo agent tool

mara ruled on #4849 (c88934): "remove create_repo tool". The tool ran in
hive-c0re with the hive's core token, so it only ever worked for agents
on the hive that runs the forge.

Removed:

- the create_repo MCP tool and CreateRepoArgs (hive-agent-mcp)
- wire variants Request::CreateRepo and Response::RepoCreated
  (hive-core-agent-sock)
- hive-c0re's handle_create_repo, its valid_repo_name check and the
  dispatch arm
- forge::create_agent_repo and apply_operator_branch_protection, which
  had no other caller, plus AGENTS_ORG and OPERATORS_TEAM, whose only
  users they were
- the tool's docs (docs/tools/forge.md repo management, docs/turn-loop/
  mcp.md, the conventions tool-group table) and the doc comments that
  named it (hive-sock-client's response timeout, ensure_repo_creation_
  disabled, the security doc's merge-gate bullet)

ToolGroup::Forge is kept with no tools, the same way b88a5b24 kept
Lifecycle, so existing meta/capabilities.json grants still parse.

Forge state is untouched: existing agents/* repos keep their collaborators
and operators-team branch protection. The swarm-controller's own
create_repo (config-org repos) is a different path and is unchanged.

Closes #4849

hive-agent-mcp/src/mcp/args.rs

@@ -103,13 +103,6 @@ pub struct SetStatusArgs {
     pub text: String,
 }
 
-#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
-pub struct CreateRepoArgs {
-    /// Repo name — a single segment of letters, digits, `-`, `_`, `.`
-    /// (no leading `-`/`.`). The repo is created as `agents/<repo>`.
-    pub repo: String,
-}
-
 #[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
 pub struct GetAgentMetaArgs {
     /// Logical name of the agent to query (e.g. `"iris"`, `"manager"`).

hive-agent-mcp/src/mcp/mod.rs

@@ -24,9 +24,9 @@ mod args;
 mod render;
 
 pub use args::{
-    AckUntilArgs, CancelLooseEndArgs, CancelScheduleArgs, CompactArgs, CreateRepoArgs,
-    EditScheduleArgs, FireScheduleNowArgs, GetAgentMetaArgs, MarkTodosDoneArgs, RecvArgs,
-    RemindArgs, RequestSchedulePromptArgs, SendArgs, SetStatusArgs,
+    AckUntilArgs, CancelLooseEndArgs, CancelScheduleArgs, CompactArgs, EditScheduleArgs,
+    FireScheduleNowArgs, GetAgentMetaArgs, MarkTodosDoneArgs, RecvArgs, RemindArgs,
+    RequestSchedulePromptArgs, SendArgs, SetStatusArgs,
 };
 pub use render::{annotate_retries, format_ack, format_agent_meta, format_recv};
 
@@ -441,33 +441,6 @@ impl AgentServer {
         .await
     }
 
-    #[tool(
-        description = "Create a git repo through hive-c0re. You CANNOT create repos with your \
-        own forge token (creation is disabled) — this is the only path. The repo is created in \
-        the c0re-owned `agents` org, you're added as a write collaborator (not owner), and the \
-        default branch gets branch protection so merges require an operator-team approval — you \
-        cannot merge your own PRs. `repo` is a single name segment (letters, digits, `-`, `_`, \
-        `.`). Returns the new repo's full name + clone URL; clone it over \
-        `$HIVE_FORGE_URL/agents/<repo>.git` and push/open PRs as normal."
-    )]
-    async fn create_repo(&self, Parameters(args): Parameters<CreateRepoArgs>) -> String {
-        let log = format!("{args:?}");
-        run_tool_envelope("create_repo", log, async move {
-            let (resp, retries) = self
-                .dispatch(hive_core_agent_sock::Request::CreateRepo { repo: args.repo })
-                .await;
-            let s = match resp {
-                Ok(hive_core_agent_sock::Response::RepoCreated {
-                    full_name,
-                    clone_url,
-                }) => format!("created repo {full_name} — clone: {clone_url}"),
-                other => reply_err(other, "create_repo"),
-            };
-            annotate_retries(s, retries)
-        })
-        .await
-    }
-
     #[tool(
         description = "Schedule a reminder that lands in this agent's own inbox at a future \
         time (sender will appear as `reminder`). Use for self-paced follow-ups: 'check task \