feat(#2377): forge-webhook-triggered config-PR merge flow

Replace the request_merge_config_pr MCP tool with a Forgejo
pull_request webhook on the agent-configs org. Agents now open a
config PR normally; hive-c0re auto-queues the MergeConfigPr approval
from the webhook event — no extra tool call needed.

Changes:
- dashboard/webhook.rs: add POST /webhook/config-pr handler
  - parses Forgejo pull_request payload (opened/synchronize)
  - strips agent-configs/<agent> prefix to extract agent name
  - calls submit_merge_config_pr → queues dashboard approval card
  - always 200 to prevent Forgejo retries; errors logged at warn
- dashboard/mod.rs: wire /webhook/config-pr route
- forge/mod.rs: add ensure_config_pr_webhook() — idempotent org-level
  hook registration on agent-configs at startup; CONFIG_ORG now
  pub(crate) for webhook handler
- main.rs: call ensure_config_pr_webhook alongside knowledge webhook
- socket_server/config_approvals.rs: drop handle_request_merge_config_pr;
  make submit_merge_config_pr pub(crate) for webhook handler
- socket_server/mod.rs: re-export submit_merge_config_pr; drop dispatch arm
- hive-sh4re/src/lib.rs: remove AgentRequest::RequestMergeConfigPr
  wire type; drop from ToolGroup::Approvals tool list
- hive-ag3nt/src/mcp/: drop request_merge_config_pr tool + args struct
- docs: update approvals.md (webhook trigger), conventions.md (tool
  group), agent-hierarchy.md, tools/lifecycle.md

Hardening from #2375-merge-config-pr-hardening branch preserved:
- pr_is_open check at queue time (rejects closed/merged PRs)
- atomic fetched_sha INSERT via submit_kind(fetched_sha: Some(&sha))

Approve-handler machinery unchanged (run_merge_config_pr,
ff_push_to_main, fetch_pr_head_into_applied, mark_pr_merged).

docs/approvals.md

@@ -111,15 +111,20 @@ kind-specific payload carrier.
   row (only `ApplyCommit` populates it). See the End-to-end flow
   above.
 - `MergeConfigPr` — the PR-based config flow's counterpart to
-  `ApplyCommit`. `commit_ref` stores the **PR number** (decimal),
-  and `fetched_sha` is the PR **head sha the operator reviewed**.
-  On approve, `run_merge_config_pr` re-reads the live PR head and
-  aborts if it drifted from `fetched_sha` (re-review), then fetches
-  that head into the applied repo, eval-verifies it, fast-forwards
-  the forge config repo's `main` to it (the merge), marks the PR
-  merged (best-effort — `main` is already there), and runs the same
-  shared deploy tail as `ApplyCommit` (`deploy_applied_target`).
-  Never a first spawn.
+  `ApplyCommit`. Triggered automatically: when an agent opens (or
+  force-pushes) a PR on its `agent-configs/<agent>` forge repo,
+  hive-c0re's `/webhook/config-pr` endpoint receives the Forgejo
+  pull_request event and queues this approval row. No MCP tool call
+  needed — the forge PR IS the request. `commit_ref` stores the
+  **PR number** (decimal), and `fetched_sha` is the PR **head sha
+  at queue time** (the "reviewed" sha). On approve,
+  `run_merge_config_pr` re-reads the live PR head and aborts if it
+  drifted from `fetched_sha` (submitter must push again to
+  re-trigger), then fetches that head into the applied repo,
+  eval-verifies it, fast-forwards the forge config repo's `main` to
+  it (the merge), marks the PR merged (best-effort — `main` is
+  already there), and runs the same shared deploy tail as
+  `ApplyCommit` (`deploy_applied_target`). Never a first spawn.
 - `Spawn` — direct container creation under the default
   `agent.nix` template. `commit_ref` is empty. Submitted via
   `HostRequest::RequestSpawn` (operator-gated, the