hive-c0re: drop the remaining "mirror" wording for the removed push

The reseed bail text, the `ensure_all` doc, the forge module doc and a
rebuild comment still described hive-c0re mirroring the applied config to
`agent-configs/<name>`. State what the code does now; scope the
config-changes doc to swarm-created agents and say what a legacy agent
whose repo has no `main` gets.

Refs #4851

hive-c0re/src/forge/mod.rs

@@ -1,4 +1,4 @@
-//! Optional Forgejo wiring — config-repo mirroring, meta read-access
+//! Optional Forgejo wiring — the `core/meta` repo, meta read-access
 //! grants, and each agent's read-only grant on `internal/docs` (the
 //! swarm-controller creates that repo, with the other swarm-wide orgs,
 //! teams and repos).
@@ -360,12 +360,12 @@ async fn wait_until_ready() -> bool {
     }
 }
 
-/// Sweep every existing container (manager + sub-agents) and ensure
-/// each has a forgejo user + token, plus an `agent-configs/<name>`
-/// repo mirroring its applied config. Also seeds the `core` admin
-/// user (hive-c0re's own identity for pushing the meta repo + driving
-/// the API) and the `core/meta` repo. The `agent-configs` org itself is
-/// the swarm-controller's to ensure.
+/// Sweep the forge at startup: seed the `core` admin user (hive-c0re's own
+/// identity for pushing the meta repo + driving the API) and its token, the
+/// `core/meta` repo and the local knowledge clone, then run [`sync_agent`]
+/// over every existing container (manager + sub-agents). Agent accounts,
+/// tokens and `agent-configs/<name>` repos are the swarm-controller's, as is
+/// the `agent-configs` org; this sweep pushes nothing to them.
 /// Called once at hive-c0re startup. Per-step failures are logged
 /// but don't abort the sweep.
 pub async fn ensure_all() {

hive-c0re/src/job_queue/exec.rs

@@ -469,9 +469,9 @@ async fn run_rebuild_bookkeeping(coord: &Arc<Coordinator>, name: &str) -> Result
     // `EmitRebuilt` tail — emitting ok here and letting a failed tail `Reconcile`
     // add a contradictory !ok would double-report the same rebuild.
     // Full forge sync on every successful rebuild so the rebuild path is
-    // equivalent to the startup sweep: tokens, config-repo mirror, meta
-    // access all recover without a hive-c0re restart. (No matrix step: the
-    // swarm mints an agent's matrix account, not this hive.)
+    // equivalent to the startup sweep: meta access, the `meta` remote and the
+    // `internal/docs` grant all recover without a hive-c0re restart. (No
+    // matrix step: the swarm mints an agent's matrix account, not this hive.)
     crate::forge::sync_agent(name, crate::forge::core_token().as_deref()).await;
     // No `kick_agent` here any more — reporting from `hive-agent`'s own
     // boot instead avoids the duplicate-restart-message problem this used

hive-c0re/src/lifecycle/mod.rs

@@ -295,8 +295,8 @@ pub async fn prepare_rebuild_dirs(name: &str, paths: &AgentPaths) -> Result<()>
     {
         bail!(
             "applied repo at {} is missing its .git directory and could not be reseeded from \
-             the forge (agent-configs/{name} unreachable, not yet mirrored, or absent); \
-             destroy --purge and re-spawn this agent.",
+             the forge (agent-configs/{name} unreachable, has no `main` — never merged or \
+             never seeded — or absent); destroy --purge and re-spawn this agent.",
             paths.applied.display()
         );
     }