agents: remove send(operator) and the operator inbox; alert on turn failures

Agents reach the operator over matrix now (#5115). A `send` to
`operator` is refused, by the broker and by the MCP allow-list check,
with an error that names the matrix MCP tools. The dashboard's Y3R C4LL
tab goes with it: the operator inbox, `GET /api/operator-inbox`,
`Broker::unread_for_recipient`, and the browser notifications that only
ever fired on operator-bound messages.

The harness no longer posts turn failures and plugin-install failures
to the operator inbox. Both are already logged at warn; a new Grafana
rule, `hh-agent-turn-failed`, fires per agent on the harness's
`turn failed` line.

Dashboard-to-agent messaging (op-send, the agent web UI's message box,
mark-all-read for agent inboxes) is unchanged.

Decisions per mara on #5115: q1 a, q2 a plus a grafana alert, q3 keep
dashboard-to-agent messaging and leave swarm-level code alone.

docs/web-ui/shape.md

@@ -208,7 +208,7 @@ re-render), call `refreshState()`. State shapes live in
 `hive-c0re/src/dashboard/state_snapshot.rs::StateSnapshot` and
 `web_ui/state.rs::StateSnapshot` — when
 adding state fields, plumb through the snapshot struct and the
-relevant domain module (`swarm.js`, `call.js`, etc.) render function.
+relevant domain module (`swarm.js`, `schedules.js`, etc.) render function.
 
 **Focus preservation:** `refreshState` checks whether
 `document.activeElement` sits inside one of the managed sections