feat(#513): add ToolGroup enum, derive allowed_mcp_tools from groups + HIVE_TOOL_GROUPS env

docs/conventions.md

@@ -274,6 +274,33 @@ status_text, status_set_at, hive_name, swarm_name }`:
   `services.hyperhive.hiveName` / `services.hyperhive.swarmName`).
   Both `None` when the options aren't configured.
 
+## Tool groups
+
+The MCP tool surface an agent receives is derived from a set of named
+`ToolGroup` values (`hive_sh4re::ToolGroup`), not from a hardcoded
+binary flavor.
+
+| Group | Tools |
+|---|---|
+| `messaging` | `send`, `recv`, `ask`, `answer` |
+| `meta` | `set_status`, `get_agent_meta` |
+| `inbox` | `get_loose_ends`, `cancel_loose_end`, `remind`, `request_next_turn` |
+| `lifecycle` | `kill`, `start`, `restart`, `update` *(privileged)* |
+| `approvals` | `request_init_config`, `request_apply_commit`, `request_update_meta_inputs` *(privileged)* |
+| `scheduling` | `request_schedule_prompt`, `fire_schedule_now`, `cancel_schedule`, `edit_schedule`, `list_schedules` *(privileged)* |
+| `diagnostics` | `get_logs` *(privileged)* |
+
+**Runtime resolution** — at session start the harness reads `HIVE_TOOL_GROUPS`
+(a comma-separated list of snake_case group names written by the meta renderer
+from per-agent config). Unrecognised tokens are logged and skipped. Falls back
+to `ToolGroup::AGENT_DEFAULT` (`messaging`, `meta`, `inbox`) or
+`ToolGroup::MANAGER_DEFAULT` (all groups) when the var is absent or empty.
+
+**Updating the surface** — when a new `#[tool]` fn is added to `AgentServer`
+or `ManagerServer` in `hive-ag3nt/src/mcp.rs`, add its name to the matching
+`ToolGroup::tools()` slice in `hive-sh4re/src/lib.rs`. That's the single
+source of truth; `allowed_mcp_tools` reads it at session start.
+
 ## Async forms
 
 Dashboard + per-agent mutating forms carry `data-async`; a delegated