feat(#2377): forge-webhook-triggered config-PR merge flow

Replace the request_merge_config_pr MCP tool with a Forgejo
pull_request webhook on the agent-configs org. Agents now open a
config PR normally; hive-c0re auto-queues the MergeConfigPr approval
from the webhook event — no extra tool call needed.

Changes:
- dashboard/webhook.rs: add POST /webhook/config-pr handler
  - parses Forgejo pull_request payload (opened/synchronize)
  - strips agent-configs/<agent> prefix to extract agent name
  - calls submit_merge_config_pr → queues dashboard approval card
  - always 200 to prevent Forgejo retries; errors logged at warn
- dashboard/mod.rs: wire /webhook/config-pr route
- forge/mod.rs: add ensure_config_pr_webhook() — idempotent org-level
  hook registration on agent-configs at startup; CONFIG_ORG now
  pub(crate) for webhook handler
- main.rs: call ensure_config_pr_webhook alongside knowledge webhook
- socket_server/config_approvals.rs: drop handle_request_merge_config_pr;
  make submit_merge_config_pr pub(crate) for webhook handler
- socket_server/mod.rs: re-export submit_merge_config_pr; drop dispatch arm
- hive-sh4re/src/lib.rs: remove AgentRequest::RequestMergeConfigPr
  wire type; drop from ToolGroup::Approvals tool list
- hive-ag3nt/src/mcp/: drop request_merge_config_pr tool + args struct
- docs: update approvals.md (webhook trigger), conventions.md (tool
  group), agent-hierarchy.md, tools/lifecycle.md

Hardening from #2375-merge-config-pr-hardening branch preserved:
- pr_is_open check at queue time (rejects closed/merged PRs)
- atomic fetched_sha INSERT via submit_kind(fetched_sha: Some(&sha))

Approve-handler machinery unchanged (run_merge_config_pr,
ff_push_to_main, fetch_pr_head_into_applied, mark_pr_merged).

hive-sh4re/src/lib.rs

@@ -788,20 +788,6 @@ pub enum Request {
         #[serde(default, skip_serializing_if = "Option::is_none")]
         description: Option<String>,
     },
-    /// *(privileged)* Submit a forge config PR for the operator to review and
-    /// merge.  `agent` is the child whose `agent-configs/<agent>` forge repo
-    /// holds the PR; `pr_number` is the open PR index on that repo.
-    /// hive-c0re fetches the PR head sha at submission time (the "reviewed"
-    /// sha for the drift gate) and queues a `MergeConfigPr` approval.  On
-    /// approval, hive-c0re re-verifies the head hasn't drifted, eval-verifies
-    /// the commit, fast-forwards the forge repo's `main`, marks the PR merged,
-    /// and rebuilds the agent container.
-    RequestMergeConfigPr {
-        agent: String,
-        pr_number: u64,
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        description: Option<String>,
-    },
     /// *(privileged)* Fetch recent journal lines for a sub-agent container.
     GetLogs {
         agent: String,
@@ -1215,7 +1201,6 @@ impl ToolGroup {
             Self::Approvals => &[
                 "request_init_config",
                 "request_apply_commit",
-                "request_merge_config_pr",
                 "request_update_meta_inputs",
             ],
             Self::Scheduling => &[
@@ -1318,7 +1303,7 @@ impl ToolGroup {
                 "kill, start, restart, update, list_containers — container lifecycle (privileged)"
             }
             Self::Approvals => {
-                "request_init_config, request_apply_commit, request_merge_config_pr, request_update_meta_inputs — config change flow (privileged)"
+                "request_init_config, request_apply_commit, request_update_meta_inputs — config change flow (privileged)"
             }
             Self::Scheduling => {
                 "request_schedule_prompt and related — operator-visible scheduled prompts (privileged)"