drop the hive's push of the legacy core/meta repo

Nothing reads core/meta: builds come from internal/meta. Remove push_meta, ensure_meta_remote, meta_read_access, ensure_repo, the per-agent forge sync that only served them, and the git commit path in meta.rs; remove_permission_files now just deletes the seed files.

docs/agent-lifecycle/config-changes.md

@@ -289,8 +289,8 @@ mounts via `set_nspawn_flags`:
   manage any agent", so the mounted set is every agent.
 - `/var/lib/hyperhive/applied/` → `/applied/` (RO) — every agent's
   authoritative applied repo, including `.git`.
-- `/var/lib/hyperhive/meta/` → `/meta/` (RO) — the swarm-wide
-  deploy flake.
+- `/var/lib/hyperhive/meta/` → `/meta/` (RO) — the hive's plain state
+  (topology, swarm limits).
 
 An agent without the permission only has its direct children's config
 dirs.

docs/agent-lifecycle/persistence.md

@@ -387,17 +387,12 @@ here from merged config PRs) + any other files those PRs commit.
 `.git/` carries the proposal / approved / building / deployed / failed /
 denied tag history.
 
-Under `/var/lib/hyperhive/meta/` — the swarm-wide deploy flake plus
-system-level config files. Single git repo for the whole host; hive-c0re
-commits every mutation that should survive a restart here.
-Contents:
+Under `/var/lib/hyperhive/meta/` — system-level config files, plain state
+with no git history that anything reads. The flake agents build from is the
+swarm's `internal/meta`, not here. Contents:
 
-- `flake.nix` — declares one `nixpkgs` input per agent + one
-  `nixosConfigurations.<n>` output per agent. `flake.lock` is the
-  canonical "what's deployed where." The git log is the deploy
-  audit trail (one commit per successful deploy or hyperhive bump).
 - `topology.json` — the agent roster (`["alice", "bob", "ruth"]`).
-  Written by `topology::reconcile` on every meta sync; read by
+  Written by `topology::reconcile` from `agent_set::refresh`; read by
   `topology::all_agents`, which is the set the `manage_root_agent`
   permission grants mounts over. The reader also accepts a map-shaped
   file carrying a `parent` per agent, and keeps its keys.
@@ -419,13 +414,13 @@ Contents:
   hive-wide only and come straight off `HiveEnv`, so this file has no field
   for them.
 - `resource-limits.json` — retired. Per-agent overrides set on the hive used
-  to live here; nothing reads or writes it now. An old copy in the meta repo
+  to live here; nothing reads or writes it now. An old copy in this directory
   is harmless and you can delete it.
 
 An agent holding `manage_root_agent`, normally ruth, has the meta dir
 RO-mounted at `/meta/`.
 
-Outside the meta repo, `/var/lib/hyperhive/swarm-agent-permissions.json`
+Outside this directory, `/var/lib/hyperhive/swarm-agent-permissions.json`
 holds the permissions the swarm grants this hive's agents, as
 `workers::swarm_permissions` last read them from the swarm's
 `agent-permissions` bucket (every 30 seconds): a copy, not the

docs/integrations/forge.md

@@ -122,9 +122,7 @@ Two things live in the `agent-configs` Forgejo organization:
   [config-changes.md § Config changes](../agent-lifecycle/config-changes.md#config-changes)).
   hive-c0re pushes nothing to this org; it only reads from it.
   Repos stay private, so an agent can't read another
-  agent's config. (Agents remain read-only collaborators on the legacy
-  `core/meta`, the hive's old permission-seed repo.)
-  The agent's **persistent meta flake input** is this repo's `main` head,
+  agent's config. The agent's **persistent meta flake input** is this repo's `main` head,
   pinned by sha in `internal/meta` (`agent-<n>.url =
 git+<forge>/agent-configs/<n>.git?rev=<sha>`; see
   [config-changes.md § Meta flake](../agent-lifecycle/config-changes.md#meta-flake)).

docs/web-ui/shape.md

@@ -233,10 +233,10 @@ enough — wiping and rebuilding still destroys the state even if
 `JSON.stringify({...visible fields...})`. On each render, the pattern
 reuses cache-hit rows verbatim (preserving textarea draft, checkbox
 state, and event listeners) and rebuilds only cache-miss rows. Used for: containers (`containerRowCache`),
-rebuild-queue entries (`rebuildQueueRowCache`). The spawn-form input+focus and meta-input
-checkboxes use a lighter snapshot-then-restore pattern (snapshot
-before `replaceChildren`, restore after) since they're single
-values rather than per-row caches.
+rebuild-queue entries (`rebuildQueueRowCache`). The spawn-form input+focus
+uses a lighter snapshot-then-restore pattern (snapshot
+before `replaceChildren`, restore after) since it's a single
+value rather than a per-row cache.
 
 <!-- vale write-good.Passive = NO -->