feat(#2346): request_merge_config_pr — submission path for the PR-based config flow

MergeConfigPr approvals had a fully-implemented approve handler
(run_merge_config_pr, ff_push_to_main, mark_pr_merged) and dashboard
display, but no way to submit one.  An agent with the `approvals` tool
group calling request_merge_config_pr(agent, pr_number) is the missing
piece.

What this adds:
- RequestMergeConfigPr variant in hive-sh4re AgentRequest + ToolGroup::Approvals
- submit_merge_config_pr: fetches PR head sha (the drift-gate reviewed sha),
  queues a MergeConfigPr row, sets fetched_sha, emits approval_added with
  pr_number so the dashboard card links to the forge PR
- handle_request_merge_config_pr: topology (require_descendant) +
  tool-group (require_group(approvals)) guards before submit
- socket_server/mod.rs: dispatch arm for RequestMergeConfigPr
- hive-ag3nt MCP tool: request_merge_config_pr with full description
- docs/tools/lifecycle.md: documents the new tool + boundary table row

Unlike submit_apply_commit, no flake pre-flight at submission time (eval-
verify happens at approval time inside run_merge_config_pr, same as the
rest of the merge pipeline).  Applied repo must already exist (guard added
with a clear error message pointing at request_apply_commit for first-spawn).

hive-ag3nt/src/mcp/args.rs

@@ -222,6 +222,17 @@ pub struct RequestApplyCommitArgs {
     pub description: Option<String>,
 }
 
+#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
+pub struct RequestMergeConfigPrArgs {
+    /// Logical agent name whose `agent-configs/<agent>` forge repo holds the PR.
+    pub agent: String,
+    /// Open PR index on the `agent-configs/<agent>` repo.
+    pub pr_number: u64,
+    /// Optional description shown on the dashboard approval card.
+    #[serde(default)]
+    pub description: Option<String>,
+}
+
 #[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
 pub struct UpdateMetaInputsArgs {
     /// Flake input names to update (e.g. `["bitburner-agent", "nixpkgs"]`).

hive-ag3nt/src/mcp/mod.rs

@@ -29,8 +29,8 @@ pub use args::{
     AckUntilArgs, AgentGetLooseEndsArgs, AnswerArgs, AskArgs, CancelLooseEndArgs,
     CancelScheduleArgs, CreateRepoArgs, EditScheduleArgs, FireScheduleNowArgs, GetAgentMetaArgs,
     GetHostJournalArgs, GetLogsArgs, KillArgs, RecvArgs, RemindArgs, RequestApplyCommitArgs,
-    RequestInitConfigArgs, RequestSchedulePromptArgs, RestartArgs, SendArgs, SetStatusArgs,
-    StartArgs, UpdateArgs, UpdateMetaInputsArgs,
+    RequestInitConfigArgs, RequestMergeConfigPrArgs, RequestSchedulePromptArgs, RestartArgs,
+    SendArgs, SetStatusArgs, StartArgs, UpdateArgs, UpdateMetaInputsArgs,
 };
 pub use render::{
     IDLE_WAIT_HINT, REDELIVERY_HINT, annotate_retries, format_ack, format_agent_meta, format_recv,
@@ -757,6 +757,47 @@ impl AgentServer {
         .await
     }
 
+    // IMPORTANT: this tool is only available when the `approvals` tool group
+    // is configured for the agent. hive-c0re enforces both the tool-group check
+    // and topology: the target must be in the caller's subtree.
+    #[tool(
+        description = "Submit an open forge PR on `agent-configs/<agent>` for the operator \
+            to review and merge into the agent's running config. Requires the `approvals` \
+            tool group. `agent` must be in this agent's subtree. `pr_number` is the PR \
+            index on the `agent-configs/<agent>` repo. hive-c0re fetches the PR head sha \
+            at submission time (the drift-gate sha); if the PR head moves before the \
+            operator approves, the approve handler aborts without making any changes — the \
+            submitter must re-submit. On approval hive-c0re eval-verifies the head, \
+            fast-forwards the forge repo's `main`, marks the PR merged, and rebuilds the \
+            agent container."
+    )]
+    async fn request_merge_config_pr(
+        &self,
+        Parameters(args): Parameters<RequestMergeConfigPrArgs>,
+    ) -> String {
+        let log = format!("{args:?}");
+        let agent = args.agent.clone();
+        let pr_number = args.pr_number;
+        run_tool_envelope("request_merge_config_pr", log, async move {
+            let (resp, retries) = self
+                .dispatch(hive_sh4re::Request::RequestMergeConfigPr {
+                    agent: args.agent,
+                    pr_number: args.pr_number,
+                    description: args.description,
+                })
+                .await;
+            annotate_retries(
+                format_ack(
+                    resp,
+                    "request_merge_config_pr",
+                    format!("merge_config_pr approval queued for {agent} PR #{pr_number}"),
+                ),
+                retries,
+            )
+        })
+        .await
+    }
+
     // IMPORTANT: this tool is only available when the `lifecycle` tool group
     // is granted to this agent. hive-c0re enforces the topology check
     // server-side: the call is rejected unless `name` is a direct child.