hive-c0re: seed an agent's proposed config from the forge when it exists

The swarm writes agent-configs/<agent> when it creates an agent, before
any hive is told to deploy it. setup_proposed authored a second copy of
those same bytes locally, so an agent's initial config had two sources
of truth, each unaware of the other and free to disagree. It now clones
that repo and falls back to the template only when there is nothing
there to take.

Preferred-source rather than a new-path-only variant because
provision_container is the Provision node for the swarm deploy and the
approval flow both, and cannot tell them apart. The approval flow
creates agent-configs/<agent> only after the first spawn
(forge_after_first_spawn), so it finds nothing and lands on the
template: the fallback becomes unreachable when hive-level create is
removed, rather than becoming something someone has to find and delete.

clone, not the neighbouring init+fetch. A failed fetch leaves an empty
.git behind, and that .git is exactly the byte setup_proposed reads to
decide whether seeding is still needed, so the fallback would have seen
a seeded repo. git removes a directory it created when a clone fails.
--branch main also makes an empty repo fail cleanly instead of cloning
to an unborn HEAD that would look seeded.

hive-c0re/src/lifecycle/tests.rs

@@ -6,6 +6,10 @@ use super::*;
 /// Regression test: `setup_proposed` must seed both agent.nix and flake.nix
 /// in the initial commit. Before commit 5b5a93e flake.nix was missing from
 /// the scaffold, requiring manual creation (seen with the damocles agent).
+///
+/// Exercises the template arm: there is no forge to clone from in a test
+/// (`forge::is_present` needs the priv socket), so `setup_proposed` falls
+/// through to `seed_template` — which is the arm this asserts about.
 #[tokio::test]
 async fn setup_proposed_seeds_flake_nix() {
     let dir = tempfile::tempdir().expect("tempdir");