remove the hive-side auto-spawn of ruth and the ruthless option

ruth is created from the swarm dashboard like any agent. An existing ruth container starts at boot through the boot reconcile, like every other agent. A definition of services.hyperhive.ruthless now fails evaluation with a removal message.

hive-c0re/src/lifecycle/mod.rs

@@ -225,15 +225,6 @@ async fn port_collision(self_name: &str) -> Result<Option<String>> {
     Ok(None)
 }
 
-pub async fn spawn(name: &str, hive: &HiveEnv, paths: &AgentPaths) -> Result<()> {
-    create_container(name, hive, paths).await?;
-    // Runtime dir must exist before nixos-container start (nspawn bind-mount
-    // source). Create it here so callers don't need a separate preamble step.
-    ensure_agent_runtime_dir(name)?;
-    write_dropins(name, hive, paths).await?;
-    priv_run("start", name).await
-}
-
 /// First-spawn pre-create provisioning — the job queue's `Provision`
 /// node. Fail fast on a port collision, set up the proposed/applied
 /// repos + state subvolume + claude/notes dirs, then register the new
@@ -266,16 +257,6 @@ pub async fn create_only(name: &str) -> Result<()> {
     priv_run("create", name).await
 }
 
-/// First-spawn provisioning + `nixos-container create`, without the
-/// drop-in write or the start. `spawn` composes this with
-/// `write_dropins` + start for direct callers (root-agent bootstrap);
-/// the job queue instead runs `provision_container` (`Provision` node)
-/// and `create_only` (`Create` node) as separate DAG steps.
-pub async fn create_container(name: &str, hive: &HiveEnv, paths: &AgentPaths) -> Result<()> {
-    provision_container(name, hive, paths).await?;
-    create_only(name).await
-}
-
 /// Rebuild-path preamble, run by the job queue's `Prebuild` node: fail fast on
 /// a port collision, then make sure the applied repo + state dirs exist.
 /// Container untouched.