forge: auto-set agent-configs org avatar on core start (#424)

Sibling to ensure_core_avatar (#320). Same one-shot marker-guarded
upload pattern, this time aimed at the Forgejo per-org avatar
endpoint (`POST /api/v1/orgs/{org}/avatar`).

## SVG-to-PNG at build time

Mara: *don't check in the png. instead generate png on the fly or
in build.*

`hive-c0re/build.rs` renders `branding/agent-configs.svg` →
`$OUT_DIR/agent-configs.png` via `rsvg-convert` (librsvg) on every
compile; `forge.rs` then `include_bytes!`s the OUT_DIR PNG. The
raster never gets checked into git — SVG stays source of truth,
the PNG is a build artifact.

- `hive-c0re/Cargo.toml`: declares `build = "build.rs"`
- `flake.nix`: adds `librsvg` to `naersk-lib.buildPackage`
  `nativeBuildInputs` (covers both the runtime package and the
  clippy check derivation) and to the dev shell so local
  `cargo build` finds `rsvg-convert` on PATH.
- For dev builds outside Nix, install librsvg (Debian:
  `librsvg2-bin`, macOS: `brew install librsvg`).

## Icon design

Sibling visual to the main hyperhive mark — same dark base + outer
ring + corner-bracket frame so the family reads at a glance. Centre
swaps the hexagonal hive for a stacked-config-files motif: three
offset sheets, folded-corner affordance, curly-brace `{ }` glyph
telegraphing "config file."

Brace font-size dropped 78→56 + letter-spacing -3 (#424 mara:
"braces cross the boundaries of the page") so the glyphs sit
comfortably inside the 120-wide front sheet with clear breathing
room on the left/right edges. The stack is shifted so the front
sheet centres on canvas-(150, 150); brace text anchors there with
`dominant-baseline=central` for true vertical centring.

## Validation

- `cargo check` clean (only pre-existing warnings).
- One-shot marker honoured: re-runs of `ensure_all` skip after the
  first success; `rm /var/lib/hyperhive/forge-agent-configs-avatar-set`
  forces re-upload (useful for icon revisions).
- Behaviour mirrors the existing `ensure_core_avatar` pattern.

Browser smoke test isn't possible from inside iris's container.
Worth eyeballing post-deploy: `http://localhost:3000/agent-configs`
should show the new avatar where the default identicon used to be.

hive-c0re/build.rs

@@ -0,0 +1,49 @@
+//! Render `branding/agent-configs.svg` → `$OUT_DIR/agent-configs.png`
+//! at compile time so the daemon can `include_bytes!` the PNG without
+//! checking the raster into git (#424 mara: "generate png on the fly
+//! or in build"). The SVG is the source of truth; the PNG is a build
+//! artifact.
+//!
+//! Uses `rsvg-convert` from PATH (librsvg, already available in
+//! nixpkgs and added to the naersk derivation's `nativeBuildInputs`
+//! in `flake.nix`). For dev builds outside Nix, install librsvg via
+//! your system package manager (Debian/Ubuntu: `librsvg2-bin`,
+//! macOS: `brew install librsvg`).
+
+use std::env;
+use std::path::PathBuf;
+use std::process::Command;
+
+const SVG_PATH: &str = "../branding/agent-configs.svg";
+const PNG_NAME: &str = "agent-configs.png";
+// 300×300 to match the existing branding/hyperhive.png, which the
+// Forgejo avatar endpoint accepts without resizing on upload.
+const PX: &str = "300";
+
+fn main() {
+    // Re-run the build script when either the SVG itself or this
+    // script change. We deliberately don't watch every file in
+    // `branding/` — only the one PNG we generate.
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-changed={SVG_PATH}");
+
+    let out_dir = PathBuf::from(env::var("OUT_DIR").expect("OUT_DIR set by cargo"));
+    let png_path = out_dir.join(PNG_NAME);
+
+    let status = Command::new("rsvg-convert")
+        .args(["--width", PX, "--height", PX, "-o"])
+        .arg(&png_path)
+        .arg(SVG_PATH)
+        .status();
+
+    match status {
+        Ok(s) if s.success() => {}
+        Ok(s) => panic!("rsvg-convert exited with {s} rendering {SVG_PATH}"),
+        Err(e) => panic!(
+            "failed to invoke rsvg-convert: {e}\n\
+             install librsvg (Debian/Ubuntu: librsvg2-bin, macOS: brew install librsvg, \
+             NixOS: pkgs.librsvg). The Nix derivation already pulls it in via \
+             flake.nix → naersk-lib.buildPackage.nativeBuildInputs.",
+        ),
+    }
+}