refactor(#2916): drop the two obsolete startup migrations

Phase 4 (repoint every container onto `meta#<n>`) and phase 5 (rename
the `root` container to `h-root`) were marker-guarded one-shots for
layouts no live hive still has: containers are rendered onto `meta#<n>`
at creation, and the `h-` prefix has been the naming for far longer than
any deployment predates. A one-shot nobody can still trigger is dead
weight, so both are gone along with `repoint_container`,
`rename_manager_container`, `CONTAINER_TIMEOUT` and the two marker paths.

Phase 6 was not obsolete, only misplaced. Ruth's tool groups are now
seeded by `ensure_root_agent` on the one path that creates her, rather
than re-asserted on every hive-c0re boot. The skip-if-already-set guard
survives the move: a destroy+recreate under the same name must not reset
an operator's chosen group set back to MANAGER_DEFAULT.

That also settles a latent bug. Phase 4's marker check was a `return`,
not a skip, so on any hive carrying the marker phases 5 and 6 never ran
at all — the tool-group backfill, whose whole job was preventing a silent
privilege downgrade, has not executed here in a long time. Moving it to
create-time removes the question rather than answering it.

What stays is convergence: three unguarded, idempotent phases that re-run
each boot and no-op once their state is right. The module doc now names
the three categories so the next person can tell which kind they're
adding.

docs/approvals.md

@@ -478,12 +478,16 @@ each phase is a no-op once already applied. Behaviour:
   dirs, or claude creds.
 - Meta-flake phase: rewrites each `applied/<n>/flake.nix` to
   the module-only boilerplate, wires the `applied` remote in
-  each proposed repo, bootstraps the meta repo from the
-  current agent list, and `nixos-container update`s every
-  container at `meta#<n>`. The expensive last step is
-  guarded by `/var/lib/hyperhive/.meta-migration-done` so
-  it only runs once across hive-c0re restarts. Set
-  `HIVE_SKIP_META_MIGRATION=1` on the service to defer.
+  each proposed repo, and bootstraps the meta repo from the
+  current agent list. Set `HIVE_SKIP_META_MIGRATION=1` on the
+  service to defer.
+
+  A further step used to `nixos-container update` every
+  container onto `meta#<n>`, guarded by a marker file so it
+  ran once per hive. It is gone: containers have been rendered
+  onto `meta#<n>` at creation for long enough that no live hive
+  needs the repoint, and a one-shot nobody can still trigger is
+  dead weight. Same for the `root` → `h-root` container rename.
 
 No state loss in either migration. claude creds, /state/
 notes, the events DB, proposed history, and applied history

docs/persistence.md

@@ -324,11 +324,11 @@ Contents:
 
 The root agent has the meta dir RO-mounted at `/meta/`.
 
-Marker file `/var/lib/hyperhive/.meta-migration-done` is
-written by the startup migration after every container has
-been repointed at `meta#<n>`. Removing it forces a re-run on
-next hive-c0re start (idempotent — only the actual repoint
-step would re-fire).
+There is no longer a `.meta-migration-done` marker: the
+one-shot container repoint it guarded has been removed, since
+containers are rendered onto `meta#<n>` at creation. A stale
+marker file left over from an older hive is inert and can be
+deleted.
 
 ## Destroy vs purge