remove the hive-side auto-spawn of ruth and the ruthless option

ruth is created from the swarm dashboard like any agent. An existing ruth container starts at boot through the boot reconcile, like every other agent. A definition of services.hyperhive.ruthless now fails evaluation with a removal message.

docs/agent-lifecycle/agent-roster.md

@@ -80,19 +80,14 @@ module docs for the exact call chain.
 
 The **manager (`ruth`)** differs from other agents in naming/bootstrap,
 its socket flavour and its default permissions; its prompt, tool
-allow-list and state dirs work as for every other agent. A hive with
-`services.hyperhive.ruthless = true` runs no manager: `hive-c0re` skips
-its root-agent create/start sweep
-(`hive-c0re/src/workers/auto_update.rs`), and this section doesn't
-apply.
+allow-list and state dirs work as for every other agent.
 
 <!-- vale write-good.Passive = NO -->
 
 - **Naming/bootstrap** — the manager's broker recipient name, state-dir
   key, and nixos-container name are all `ruth` (container `h-ruth`).
-  `hive-c0re` spawns it directly at boot if missing, with no operator
-  approval step — every other agent is created at swarm level
-  (`swarmctl agent create`).
+  Like every agent it comes from the swarm dashboard or
+  `swarmctl agent create`; `hive-c0re` creates nothing at boot.
   Roster-wise, `ruth` is just another entry.
 - **Wire-protocol** — `hive-core-agent-sock`'s unified `Request` enum
   is the same on both socket flavours. Container lifecycle

docs/agent-lifecycle/config-changes.md

@@ -106,9 +106,8 @@ notes) is
 reuses prior config + login. With `purge = true` the agent's
 `/var/lib/hyperhive/{agents,applied}/<name>/` trees are also
 wiped (config history + creds + notes gone forever). The
-root/bootstrap container is destroyable like any other — hive-c0re
-recreates it on the next startup if it's absent, so destroying it's
-transient.
+root/bootstrap container is destroyable like any other, and stays gone
+until you create ruth again from the swarm dashboard.
 
 ## Meta flake
 
@@ -143,7 +142,7 @@ autoupdate flake-rev bump (one shot before per-agent rebuilds).
 
 `meta::sync_agents(hive: &HiveEnv, agents: &[AgentSpec])` — `hive`
 carries `hyperhive_flake`, `dashboard_port`, and the rest of the
-per-hive config — is the idempotent reconciler called by `spawn`,
+per-hive config — is the idempotent reconciler called by `provision_container`,
 `destroy`, `rebuild`, and the startup migration. Renders `flake.nix`
 from the agent list; if it differs from disk, runs
 `nix flake lock` + commits as `regenerate meta flake` (or
@@ -314,11 +313,12 @@ No state loss in either migration: claude creds, `/state/` notes, the
 events DB, and both proposed + applied history all survive. The root
 agent keeps its session; sub-agents stay logged in.
 
-## The root/bootstrap container is hive-c0re-managed
+## The root/bootstrap container
 
 The root agent container runs through the **same lifecycle as
-sub-agents**. On `hive-c0re serve` startup, if `ruth` is missing,
-hive-c0re creates it. The root agent's flake lives at
+sub-agents**. Nothing creates it at hive boot: you create ruth from the
+swarm dashboard like any agent, and an existing ruth container starts with
+the hive like every other. The root agent's flake lives at
 `/var/lib/hyperhive/applied/ruth/`; its proposed config at
 `/var/lib/hyperhive/agents/ruth/config/`. The root agent can edit its own
 `agent.nix` (visible inside the container at `/agents/ruth/config/`)
@@ -342,8 +342,8 @@ Differences from sub-agents:
   not a special manager-only path.
 
 **Migration note** (for older hosts): drop any `containers.root =
-{ ... }` block from your host NixOS config. hyperhive creates and
-updates the root agent itself.
+{ ... }` block from your host NixOS config, and any `services.hyperhive.ruthless`
+definition, then create ruth from the swarm dashboard.
 
 ## Root-agent policy
 

docs/agent-lifecycle/persistence.md

@@ -31,9 +31,9 @@ Beyond that:
   restart and rebuild** — only an explicit purge (or a hive
   `--purge`-style host operation, or the agent's own choices) touches
   them.
-- The **root/bootstrap agent is special**: it isn't really destroyable
-  in practice — hive-c0re recreates it automatically on its next
-  startup if it's ever gone.
+- The **root/bootstrap agent has no guard**: destroying ruth is as final as
+  for any agent, and she stays gone until you create her again from the
+  swarm dashboard.
 
 Everything below this point is implementation detail: exact table
 schemas, file layouts, and internal migration mechanics.
@@ -432,11 +432,9 @@ an agent's state. The mechanics, for completeness:
 - `PURG3` wipes `/var/lib/hyperhive/{agents,applied}/<name>/` — the
   union of everything `DESTR0Y` left behind.
 
-`actions::destroy` implements the root/bootstrap agent's specialness as a soft policy
-guard that refuses to destroy it, backstopped by
-`auto_update::ensure_root_agent`, which recreates it on the next
-hive-c0re startup if it's ever absent — so even without the guard,
-destroying it would only be transient.
+`actions::destroy` has no guard for the root/bootstrap agent: it destroys ruth
+like any other agent, and she stays gone until you create her again from the
+swarm dashboard.
 
 ### btrfs subvolumes for `/var/lib/hyperhive/agents/<name>`