feat(#2377): forge-webhook-triggered config-PR merge flow

Replace the request_merge_config_pr MCP tool with a Forgejo
pull_request webhook on the agent-configs org. Agents now open a
config PR normally; hive-c0re auto-queues the MergeConfigPr approval
from the webhook event — no extra tool call needed.

Changes:
- dashboard/webhook.rs: add POST /webhook/config-pr handler
  - parses Forgejo pull_request payload (opened/synchronize)
  - strips agent-configs/<agent> prefix to extract agent name
  - calls submit_merge_config_pr → queues dashboard approval card
  - always 200 to prevent Forgejo retries; errors logged at warn
- dashboard/mod.rs: wire /webhook/config-pr route
- forge/mod.rs: add ensure_config_pr_webhook() — idempotent org-level
  hook registration on agent-configs at startup; CONFIG_ORG now
  pub(crate) for webhook handler
- main.rs: call ensure_config_pr_webhook alongside knowledge webhook
- socket_server/config_approvals.rs: drop handle_request_merge_config_pr;
  make submit_merge_config_pr pub(crate) for webhook handler
- socket_server/mod.rs: re-export submit_merge_config_pr; drop dispatch arm
- hive-sh4re/src/lib.rs: remove AgentRequest::RequestMergeConfigPr
  wire type; drop from ToolGroup::Approvals tool list
- hive-ag3nt/src/mcp/: drop request_merge_config_pr tool + args struct
- docs: update approvals.md (webhook trigger), conventions.md (tool
  group), agent-hierarchy.md, tools/lifecycle.md

Hardening from #2375-merge-config-pr-hardening branch preserved:
- pr_is_open check at queue time (rejects closed/merged PRs)
- atomic fetched_sha INSERT via submit_kind(fetched_sha: Some(&sha))

Approve-handler machinery unchanged (run_merge_config_pr,
ff_push_to_main, fetch_pr_head_into_applied, mark_pr_merged).

hive-ag3nt/src/mcp/args.rs

@@ -222,17 +222,6 @@ pub struct RequestApplyCommitArgs {
     pub description: Option<String>,
 }
 
-#[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
-pub struct RequestMergeConfigPrArgs {
-    /// Logical agent name whose `agent-configs/<agent>` forge repo holds the PR.
-    pub agent: String,
-    /// Open PR index on the `agent-configs/<agent>` repo.
-    pub pr_number: u64,
-    /// Optional description shown on the dashboard approval card.
-    #[serde(default)]
-    pub description: Option<String>,
-}
-
 #[derive(Debug, serde::Deserialize, schemars::JsonSchema)]
 pub struct UpdateMetaInputsArgs {
     /// Flake input names to update (e.g. `["bitburner-agent", "nixpkgs"]`).

hive-ag3nt/src/mcp/mod.rs

@@ -29,8 +29,8 @@ pub use args::{
     AckUntilArgs, AgentGetLooseEndsArgs, AnswerArgs, AskArgs, CancelLooseEndArgs,
     CancelScheduleArgs, CreateRepoArgs, EditScheduleArgs, FireScheduleNowArgs, GetAgentMetaArgs,
     GetHostJournalArgs, GetLogsArgs, KillArgs, RecvArgs, RemindArgs, RequestApplyCommitArgs,
-    RequestInitConfigArgs, RequestMergeConfigPrArgs, RequestSchedulePromptArgs, RestartArgs,
-    SendArgs, SetStatusArgs, StartArgs, UpdateArgs, UpdateMetaInputsArgs,
+    RequestInitConfigArgs, RequestSchedulePromptArgs, RestartArgs, SendArgs, SetStatusArgs,
+    StartArgs, UpdateArgs, UpdateMetaInputsArgs,
 };
 pub use render::{
     IDLE_WAIT_HINT, REDELIVERY_HINT, annotate_retries, format_ack, format_agent_meta, format_recv,
@@ -757,47 +757,6 @@ impl AgentServer {
         .await
     }
 
-    // IMPORTANT: this tool is only available when the `approvals` tool group
-    // is configured for the agent. hive-c0re enforces both the tool-group check
-    // and topology: the target must be in the caller's subtree.
-    #[tool(
-        description = "Submit an open forge PR on `agent-configs/<agent>` for the operator \
-            to review and merge into the agent's running config. Requires the `approvals` \
-            tool group. `agent` must be in this agent's subtree. `pr_number` is the PR \
-            index on the `agent-configs/<agent>` repo. hive-c0re fetches the PR head sha \
-            at submission time (the drift-gate sha); if the PR head moves before the \
-            operator approves, the approve handler aborts without making any changes — the \
-            submitter must re-submit. On approval hive-c0re eval-verifies the head, \
-            fast-forwards the forge repo's `main`, marks the PR merged, and rebuilds the \
-            agent container."
-    )]
-    async fn request_merge_config_pr(
-        &self,
-        Parameters(args): Parameters<RequestMergeConfigPrArgs>,
-    ) -> String {
-        let log = format!("{args:?}");
-        let agent = args.agent.clone();
-        let pr_number = args.pr_number;
-        run_tool_envelope("request_merge_config_pr", log, async move {
-            let (resp, retries) = self
-                .dispatch(hive_sh4re::Request::RequestMergeConfigPr {
-                    agent: args.agent,
-                    pr_number: args.pr_number,
-                    description: args.description,
-                })
-                .await;
-            annotate_retries(
-                format_ack(
-                    resp,
-                    "request_merge_config_pr",
-                    format!("merge_config_pr approval queued for {agent} PR #{pr_number}"),
-                ),
-                retries,
-            )
-        })
-        .await
-    }
-
     // IMPORTANT: this tool is only available when the `lifecycle` tool group
     // is granted to this agent. hive-c0re enforces the topology check
     // server-side: the call is rejected unless `name` is a direct child.