docs/integrations: correct what runs at hive vs swarm level

knowledge.md: swarm-controller's site-admin account also pushes; the
clone no longer carries a token, the .git overlay hides history.
forge.md: the dashboard link follows swarm.forge.publicUrl; the poller's
HIVE_FORGE_URL gate is only unmet outside a nix-built hive.
matrix.md: the homeserver is the swarm's, not the hive's.

docs/integrations/forge.md

@@ -122,8 +122,9 @@ Two things live in the `agent-configs` Forgejo organization:
   see [config-changes.md § Meta flake](../agent-lifecycle/config-changes.md#meta-flake)), fetching it as the `core`
   user via a git credential helper that reads the live forge-core token —
   so the config lives on the forge, not a hand-synced local checkout.
-- The dashboard links each container's "config" anchor to this
-  config repo, so operators can go straight from the SW4RM tab into
+- The dashboard links each container's deployed config commit to this
+  config repo on the swarm's forge (`swarm.forge.publicUrl`; `null` means no
+  link), so operators can go straight from the SW4RM tab into
   the rendered repo without an extra `git` step.
 
 The `hive-forge` CLI (separate workspace crate, see
@@ -205,8 +206,8 @@ read directly without a delivery — same `mark_read` call, no wake.
 
 The poller starts disabled and stays that way for any of:
 
-- `HIVE_FORGE_URL` not set (no forge configured for this hive), or
-  not parseable as a URL.
+- `HIVE_FORGE_URL` not set or not parseable as a URL (a hand-run
+  harness; hive-c0re sets it from `swarm.forge.domain` on every hive).
 - no token in `$HIVE_FORGE_TOKEN_FILE` or `<state>/forge-token` (agent has no forge
   account — pre-provisioning or destroy-without-purge race).
 - Initial client construction fails (the typed `forgejo-api` client
@@ -325,7 +326,7 @@ to `closed_at` that `state_change_is_current` returns `true` — so it takes
 the state-change path, dropping its body. Best of both worlds:
 on the merge/close path `forge_notify` fetches the `latest_comment_url` comment and, when
 its `created_at` is strictly **after** the subject's `closed_at`
-(`comment_is_after_close`) — that is, it raced the merge rather than being the
+(`comment_is_after_close`) — in other words, it raced the merge rather than being the
 pre-merge last comment the subject keeps — append it as a
 `comment by <author>: <excerpt>` block before the meta suffix
 (`fresh_post_close_comment_tail`). The wake carries **both** `[PR merged]`