hive reads the forge for nix as its own account, not core

hive-c0re copies the hive's store read token to /run/hyperhive/forge-hive-token
for nix's git credential helper, and no longer mints, reads or falls back to
the core admin token. drops the core user sweep, avatar upload, webhook
cleanup and hive-priv's RunForgeAdmin.

hive-c0re/src/job_queue/exec.rs

@@ -119,11 +119,11 @@ pub(super) async fn run_node(
     (builder, result)
 }
 
-/// Boot-time forge user/token sweep as a DAG node — see
-/// [`NodeKind::ForgeSweep`]. `forge::ensure_all` already does its own
-/// per-step error handling and boot warnings internally (it's
-/// best-effort by design), so this wrapper has nothing left to report;
-/// it exists purely to make the sweep a visible unit of work.
+/// Boot-time publish of the hive's forge credential for nix, as a DAG node —
+/// see [`NodeKind::ForgeSweep`]. `forge::ensure_all` logs its own outcome and
+/// is best-effort (a build re-publishes the credential before it fetches), so
+/// this wrapper has nothing left to report; it exists to make the step a
+/// visible unit of work.
 async fn run_forge_sweep() -> Result<()> {
     crate::forge::ensure_all().await;
     Ok(())

hive-c0re/src/job_queue/model.rs

@@ -96,8 +96,8 @@ pub enum NodeKind {
     /// Write the agent's durable power intent (`wanted = Up` when `up`,
     /// else `Offline`) as the head node of a power-op DAG.
     SetWanted { agent: String, up: bool },
-    /// One-shot boot-time forge user/token sweep for every existing
-    /// container (`forge::ensure_all`). Agentless.
+    /// One-shot boot-time publish of the hive's forge read token for nix
+    /// (`forge::ensure_all`). Agentless.
     ForgeSweep,
     /// Matrix user/space sweep (`matrix::ensure_all`): at boot and every 30
     /// minutes. Agentless.