feat(#2346): request_merge_config_pr — submission path for the PR-based config flow

MergeConfigPr approvals had a fully-implemented approve handler
(run_merge_config_pr, ff_push_to_main, mark_pr_merged) and dashboard
display, but no way to submit one.  An agent with the `approvals` tool
group calling request_merge_config_pr(agent, pr_number) is the missing
piece.

What this adds:
- RequestMergeConfigPr variant in hive-sh4re AgentRequest + ToolGroup::Approvals
- submit_merge_config_pr: fetches PR head sha (the drift-gate reviewed sha),
  queues a MergeConfigPr row, sets fetched_sha, emits approval_added with
  pr_number so the dashboard card links to the forge PR
- handle_request_merge_config_pr: topology (require_descendant) +
  tool-group (require_group(approvals)) guards before submit
- socket_server/mod.rs: dispatch arm for RequestMergeConfigPr
- hive-ag3nt MCP tool: request_merge_config_pr with full description
- docs/tools/lifecycle.md: documents the new tool + boundary table row

Unlike submit_apply_commit, no flake pre-flight at submission time (eval-
verify happens at approval time inside run_merge_config_pr, same as the
rest of the merge pipeline).  Applied repo must already exist (guard added
with a clear error message pointing at request_apply_commit for first-spawn).

docs/tools/lifecycle.md

@@ -64,6 +64,24 @@ pinned commit.
 rejected — the approval pins the exact commit). `agent` must be a
 direct child. Topology-enforced.
 
+### `request_merge_config_pr(agent, pr_number, description?)`
+
+Submit an open PR on the agent's `agent-configs/<agent>` forge repo for
+operator review and merge.  The PR-based config flow's counterpart to
+`request_apply_commit`: instead of pinning a commit sha from the proposed
+repo, the submitter references an already-open forge PR.
+
+hive-c0re fetches the PR head sha at submission time (the "reviewed" sha);
+on operator approval it re-checks for drift, eval-verifies the commit,
+fast-forwards the forge repo's `main` to the reviewed sha, marks the PR
+merged, and rebuilds the agent container.  If the PR head moves between
+submission and approval the approve handler aborts — the submitter must
+re-submit.
+
+`agent` must be in the caller's subtree.  The agent must already be fully
+provisioned (applied repo present); this tool is not for first-spawn.
+Requires the `approvals` tool group.
+
 ### `request_update_meta_inputs(inputs?, description?)`
 
 Queue an approval to run `nix flake update [inputs...]` on the meta
@@ -81,8 +99,9 @@ agents after the approval resolves.
 | `kill` / `start` / `restart` / `update` | No                 | Direct children       |
 | `list_containers`                       | No                 | All descendants       |
 | `request_init_config`                   | Yes (InitConfig)   | New direct child only |
-| `request_apply_commit`                  | Yes (ApplyCommit)  | Direct children       |
-| `request_update_meta_inputs`            | Yes (MetaUpdate)   | Meta flake (global)   |
+| `request_apply_commit`                  | Yes (ApplyCommit)      | Direct children       |
+| `request_merge_config_pr`               | Yes (MergeConfigPr)    | Descendants           |
+| `request_update_meta_inputs`            | Yes (MetaUpdate)       | Meta flake (global)   |
 
 ## See also