feat(#2377): forge-webhook-triggered config-PR merge flow

Replace the request_merge_config_pr MCP tool with a Forgejo
pull_request webhook on the agent-configs org. Agents now open a
config PR normally; hive-c0re auto-queues the MergeConfigPr approval
from the webhook event — no extra tool call needed.

Changes:
- dashboard/webhook.rs: add POST /webhook/config-pr handler
  - parses Forgejo pull_request payload (opened/synchronize)
  - strips agent-configs/<agent> prefix to extract agent name
  - calls submit_merge_config_pr → queues dashboard approval card
  - always 200 to prevent Forgejo retries; errors logged at warn
- dashboard/mod.rs: wire /webhook/config-pr route
- forge/mod.rs: add ensure_config_pr_webhook() — idempotent org-level
  hook registration on agent-configs at startup; CONFIG_ORG now
  pub(crate) for webhook handler
- main.rs: call ensure_config_pr_webhook alongside knowledge webhook
- socket_server/config_approvals.rs: drop handle_request_merge_config_pr;
  make submit_merge_config_pr pub(crate) for webhook handler
- socket_server/mod.rs: re-export submit_merge_config_pr; drop dispatch arm
- hive-sh4re/src/lib.rs: remove AgentRequest::RequestMergeConfigPr
  wire type; drop from ToolGroup::Approvals tool list
- hive-ag3nt/src/mcp/: drop request_merge_config_pr tool + args struct
- docs: update approvals.md (webhook trigger), conventions.md (tool
  group), agent-hierarchy.md, tools/lifecycle.md

Hardening from #2375-merge-config-pr-hardening branch preserved:
- pr_is_open check at queue time (rejects closed/merged PRs)
- atomic fetched_sha INSERT via submit_kind(fetched_sha: Some(&sha))

Approve-handler machinery unchanged (run_merge_config_pr,
ff_push_to_main, fetch_pr_head_into_applied, mark_pr_merged).

hive-c0re/src/main.rs

@@ -303,17 +303,22 @@ async fn cmd_serve(
     tokio::spawn(async move {
         forge::ensure_all().await;
     });
-    // Knowledge webhook setup: ensure the Forgejo push webhook for
-    // `internal/knowledge` exists so `pull()` fires on merge. Runs
-    // after forge::ensure_all so the core token + repo are present.
+    // Webhook setup: ensure Forgejo webhooks are registered for both
+    // `internal/knowledge` (push → git pull) and the `agent-configs` org
+    // (pull_request → queue MergeConfigPr approval). Both run after
+    // forge::ensure_all so the core token + repos + org are present.
     // No-op when the core token or forge are absent.
     let webhook_port = dashboard_port;
     tokio::spawn(async move {
-        if let Some(token) = forge::core_token()
-            && let Err(e) = knowledge::ensure_webhook(&token, webhook_port).await
-        {
+        let Some(token) = forge::core_token() else {
+            return;
+        };
+        if let Err(e) = knowledge::ensure_webhook(&token, webhook_port).await {
             tracing::warn!(error = ?e, "knowledge: ensure_webhook failed");
         }
+        if let Err(e) = forge::ensure_config_pr_webhook(&token, webhook_port).await {
+            tracing::warn!(error = ?e, "forge: ensure_config_pr_webhook failed");
+        }
     });
     // Knowledge periodic pull: hourly fallback in case the webhook is
     // missed (e.g. hive-c0re was down during a push). First fires at