forge: auto-set agent-configs org avatar on core start (#424)

Sibling to ensure_core_avatar (#320). Same one-shot marker-guarded
upload pattern, this time aimed at the Forgejo per-org avatar
endpoint (`POST /api/v1/orgs/{org}/avatar`).

## SVG-to-PNG at build time

Mara: *don't check in the png. instead generate png on the fly or
in build.*

`hive-c0re/build.rs` renders `branding/agent-configs.svg` →
`$OUT_DIR/agent-configs.png` via `rsvg-convert` (librsvg) on every
compile; `forge.rs` then `include_bytes!`s the OUT_DIR PNG. The
raster never gets checked into git — SVG stays source of truth,
the PNG is a build artifact.

- `hive-c0re/Cargo.toml`: declares `build = "build.rs"`
- `flake.nix`: adds `librsvg` to `naersk-lib.buildPackage`
  `nativeBuildInputs` (covers both the runtime package and the
  clippy check derivation) and to the dev shell so local
  `cargo build` finds `rsvg-convert` on PATH.
- For dev builds outside Nix, install librsvg (Debian:
  `librsvg2-bin`, macOS: `brew install librsvg`).

## Icon design

Sibling visual to the main hyperhive mark — same dark base + outer
ring + corner-bracket frame so the family reads at a glance. Centre
swaps the hexagonal hive for a stacked-config-files motif: three
offset sheets, folded-corner affordance, curly-brace `{ }` glyph
telegraphing "config file."

Brace font-size dropped 78→56 + letter-spacing -3 (#424 mara:
"braces cross the boundaries of the page") so the glyphs sit
comfortably inside the 120-wide front sheet with clear breathing
room on the left/right edges. The stack is shifted so the front
sheet centres on canvas-(150, 150); brace text anchors there with
`dominant-baseline=central` for true vertical centring.

## Validation

- `cargo check` clean (only pre-existing warnings).
- One-shot marker honoured: re-runs of `ensure_all` skip after the
  first success; `rm /var/lib/hyperhive/forge-agent-configs-avatar-set`
  forces re-upload (useful for icon revisions).
- Behaviour mirrors the existing `ensure_core_avatar` pattern.

Browser smoke test isn't possible from inside iris's container.
Worth eyeballing post-deploy: `http://localhost:3000/agent-configs`
should show the new avatar where the default identicon used to be.

flake.nix

@@ -55,6 +55,12 @@
         {
           default = naersk-lib.buildPackage {
             src = ./.;
+            # librsvg ships `rsvg-convert`, which hive-c0re/build.rs
+            # invokes to render branding/agent-configs.svg into the
+            # PNG it embeds via `include_bytes!` (#424). Keeps the
+            # raster out of git — SVG stays source-of-truth, PNG is
+            # a build artifact in $OUT_DIR.
+            nativeBuildInputs = [ pkgs.librsvg ];
             meta.description = "hyperhive workspace (hive-c0re, hive-ag3nt, hive-m1nd)";
           };
           # Bundled browser assets — see ./nix/frontend.nix. Output is
@@ -152,6 +158,7 @@
             packages = with pkgs; [
               cargo
               clippy
+              librsvg # rsvg-convert — hive-c0re/build.rs invokes it (#424)
               pkg-config
               rust-analyzer
               rustc
@@ -183,6 +190,11 @@
               # Skip the actual build; we only care about the clippy lint.
               doCheck = false;
               copyTarget = false;
+              # hive-c0re/build.rs needs rsvg-convert on PATH (#424);
+              # mirror the runtime derivation's nativeBuildInputs so
+              # clippy's vendored-deps build phase doesn't break on
+              # the missing tool.
+              nativeBuildInputs = [ pkgs.librsvg ];
             }).overrideAttrs
               (old: {
                 name = "${old.name}-clippy";