feat(#2377): forge-webhook-triggered config-PR merge flow

Replace the request_merge_config_pr MCP tool with a Forgejo
pull_request webhook on the agent-configs org. Agents now open a
config PR normally; hive-c0re auto-queues the MergeConfigPr approval
from the webhook event — no extra tool call needed.

Changes:
- dashboard/webhook.rs: add POST /webhook/config-pr handler
  - parses Forgejo pull_request payload (opened/synchronize)
  - strips agent-configs/<agent> prefix to extract agent name
  - calls submit_merge_config_pr → queues dashboard approval card
  - always 200 to prevent Forgejo retries; errors logged at warn
- dashboard/mod.rs: wire /webhook/config-pr route
- forge/mod.rs: add ensure_config_pr_webhook() — idempotent org-level
  hook registration on agent-configs at startup; CONFIG_ORG now
  pub(crate) for webhook handler
- main.rs: call ensure_config_pr_webhook alongside knowledge webhook
- socket_server/config_approvals.rs: drop handle_request_merge_config_pr;
  make submit_merge_config_pr pub(crate) for webhook handler
- socket_server/mod.rs: re-export submit_merge_config_pr; drop dispatch arm
- hive-sh4re/src/lib.rs: remove AgentRequest::RequestMergeConfigPr
  wire type; drop from ToolGroup::Approvals tool list
- hive-ag3nt/src/mcp/: drop request_merge_config_pr tool + args struct
- docs: update approvals.md (webhook trigger), conventions.md (tool
  group), agent-hierarchy.md, tools/lifecycle.md

Hardening from #2375-merge-config-pr-hardening branch preserved:
- pr_is_open check at queue time (rejects closed/merged PRs)
- atomic fetched_sha INSERT via submit_kind(fetched_sha: Some(&sha))

Approve-handler machinery unchanged (run_merge_config_pr,
ff_push_to_main, fetch_pr_head_into_applied, mark_pr_merged).

hive-c0re/src/socket_server/config_approvals.rs

@@ -1,8 +1,13 @@
 //! Config-approval request handlers: `RequestInitConfig` /
-//! `RequestApplyCommit` / `RequestMergeConfigPr` / `RequestUpdateMetaInputs`,
+//! `RequestApplyCommit` / `RequestUpdateMetaInputs`,
 //! plus the shared submit helpers (`submit_init_config` / `submit_apply_commit`
 //! / `submit_merge_config_pr`) and the commit-sha shape check
 //! (`validate_commit_ref`).
+//!
+//! `submit_merge_config_pr` is called from the dashboard webhook handler
+//! (`dashboard::webhook`) — agents no longer need an MCP tool for this;
+//! opening a config PR on `agent-configs/<agent>` is enough to trigger
+//! hive-c0re's webhook-driven queue path.
 
 use std::sync::Arc;
 
@@ -107,35 +112,6 @@ pub(super) fn handle_request_update_meta_inputs(
     AgentResponse::Ok
 }
 
-/// `RequestMergeConfigPr` — queue a `MergeConfigPr` approval for a PR on an
-/// agent's `agent-configs/<agent>` forge repo.  The target must be in the
-/// caller's subtree.  hive-c0re fetches the PR head sha at submission time;
-/// that sha is stored as `fetched_sha` and forms the drift gate in the
-/// approve handler: if the PR head moves between submission and approval,
-/// the approve handler aborts without making any changes.
-pub(super) async fn handle_request_merge_config_pr(
-    coord: &Arc<Coordinator>,
-    agent: &str,
-    target_agent: &str,
-    pr_number: u64,
-    description: Option<&str>,
-) -> AgentResponse {
-    if let Some(err) = super::require_descendant(agent, target_agent, "request_merge_config_pr for")
-    {
-        return err;
-    }
-    tracing::info!(%agent, %target_agent, %pr_number, "request_merge_config_pr");
-    match submit_merge_config_pr(coord, target_agent, pr_number, description, agent).await {
-        Ok(id) => {
-            tracing::info!(%id, %target_agent, %pr_number, "merge_config_pr approval queued");
-            AgentResponse::Ok
-        }
-        Err(e) => AgentResponse::Err {
-            message: format!("{e:#}"),
-        },
-    }
-}
-
 /// Submit-time half of the PR-merge flow: fetch the PR head sha from the
 /// forge, queue the approval row, and emit the `approval_added` event so the
 /// dashboard shows the pending card immediately.
@@ -146,7 +122,7 @@ pub(super) async fn handle_request_merge_config_pr(
 /// this does NOT fetch the commit into the applied repo at submission time
 /// (that happens inside the approve handler, step 2, after the drift check).
 /// No flake pre-flight either — eval-verify happens at approval time too.
-async fn submit_merge_config_pr(
+pub(crate) async fn submit_merge_config_pr(
     coord: &Arc<Coordinator>,
     agent: &str,
     pr_number: u64,
@@ -172,7 +148,7 @@ async fn submit_merge_config_pr(
     {
         anyhow::bail!(
             "PR #{pr_number} on {repo} is closed or already merged — \
-             request_merge_config_pr requires an open PR"
+             merge_config_pr requires an open PR"
         );
     }
     // Fetch the current PR head sha — becomes the "reviewed" sha.

hive-c0re/src/socket_server/mod.rs

@@ -25,12 +25,12 @@ mod lifecycle_handlers;
 mod reminders;
 mod schedules;
 
+pub(crate) use config_approvals::{submit_init_config, submit_merge_config_pr};
 pub(crate) use schedules::filter_ghost_schedule_targets;
 pub use schedules::schedule_to_wire_public;
 
 use config_approvals::{
-    handle_request_apply_commit, handle_request_init_config, handle_request_merge_config_pr,
-    handle_request_update_meta_inputs,
+    handle_request_apply_commit, handle_request_init_config, handle_request_update_meta_inputs,
 };
 use lifecycle_handlers::{
     handle_kill, handle_list_descendants, handle_restart, handle_start, handle_update,
@@ -579,23 +579,6 @@ async fn dispatch(req: &AgentRequest, agent: &str, coord: &Arc<Coordinator>) ->
             )
             .await
         }
-        AgentRequest::RequestMergeConfigPr {
-            agent: target_agent,
-            pr_number,
-            description,
-        } => {
-            if let Some(err) = require_group(agent, "approvals", "request merge_config_pr") {
-                return err;
-            }
-            handle_request_merge_config_pr(
-                coord,
-                agent,
-                target_agent,
-                *pr_number,
-                description.as_deref(),
-            )
-            .await
-        }
         // Agent-state queries: own subtree is free; other agents + the
         // hive-wide `"*"` sweep require `QueryAgentState`.
         AgentRequest::GetLooseEnds { agent: target } => {