feat(#2346): request_merge_config_pr — submission path for the PR-based config flow

MergeConfigPr approvals had a fully-implemented approve handler
(run_merge_config_pr, ff_push_to_main, mark_pr_merged) and dashboard
display, but no way to submit one.  An agent with the `approvals` tool
group calling request_merge_config_pr(agent, pr_number) is the missing
piece.

What this adds:
- RequestMergeConfigPr variant in hive-sh4re AgentRequest + ToolGroup::Approvals
- submit_merge_config_pr: fetches PR head sha (the drift-gate reviewed sha),
  queues a MergeConfigPr row, sets fetched_sha, emits approval_added with
  pr_number so the dashboard card links to the forge PR
- handle_request_merge_config_pr: topology (require_descendant) +
  tool-group (require_group(approvals)) guards before submit
- socket_server/mod.rs: dispatch arm for RequestMergeConfigPr
- hive-ag3nt MCP tool: request_merge_config_pr with full description
- docs/tools/lifecycle.md: documents the new tool + boundary table row

Unlike submit_apply_commit, no flake pre-flight at submission time (eval-
verify happens at approval time inside run_merge_config_pr, same as the
rest of the merge pipeline).  Applied repo must already exist (guard added
with a clear error message pointing at request_apply_commit for first-spawn).

hive-sh4re/src/lib.rs

@@ -788,6 +788,20 @@ pub enum Request {
         #[serde(default, skip_serializing_if = "Option::is_none")]
         description: Option<String>,
     },
+    /// *(privileged)* Submit a forge config PR for the operator to review and
+    /// merge.  `agent` is the child whose `agent-configs/<agent>` forge repo
+    /// holds the PR; `pr_number` is the open PR index on that repo.
+    /// hive-c0re fetches the PR head sha at submission time (the "reviewed"
+    /// sha for the drift gate) and queues a `MergeConfigPr` approval.  On
+    /// approval, hive-c0re re-verifies the head hasn't drifted, eval-verifies
+    /// the commit, fast-forwards the forge repo's `main`, marks the PR merged,
+    /// and rebuilds the agent container.
+    RequestMergeConfigPr {
+        agent: String,
+        pr_number: u64,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        description: Option<String>,
+    },
     /// *(privileged)* Fetch recent journal lines for a sub-agent container.
     GetLogs {
         agent: String,
@@ -1201,6 +1215,7 @@ impl ToolGroup {
             Self::Approvals => &[
                 "request_init_config",
                 "request_apply_commit",
+                "request_merge_config_pr",
                 "request_update_meta_inputs",
             ],
             Self::Scheduling => &[
@@ -1303,7 +1318,7 @@ impl ToolGroup {
                 "kill, start, restart, update, list_containers — container lifecycle (privileged)"
             }
             Self::Approvals => {
-                "request_init_config, request_apply_commit, request_update_meta_inputs — config change flow (privileged)"
+                "request_init_config, request_apply_commit, request_merge_config_pr, request_update_meta_inputs — config change flow (privileged)"
             }
             Self::Scheduling => {
                 "request_schedule_prompt and related — operator-visible scheduled prompts (privileged)"