refactor(#2916): drop the two obsolete startup migrations

Phase 4 (repoint every container onto `meta#<n>`) and phase 5 (rename
the `root` container to `h-root`) were marker-guarded one-shots for
layouts no live hive still has: containers are rendered onto `meta#<n>`
at creation, and the `h-` prefix has been the naming for far longer than
any deployment predates. A one-shot nobody can still trigger is dead
weight, so both are gone along with `repoint_container`,
`rename_manager_container`, `CONTAINER_TIMEOUT` and the two marker paths.

Phase 6 was not obsolete, only misplaced. Ruth's tool groups are now
seeded by `ensure_root_agent` on the one path that creates her, rather
than re-asserted on every hive-c0re boot. The skip-if-already-set guard
survives the move: a destroy+recreate under the same name must not reset
an operator's chosen group set back to MANAGER_DEFAULT.

That also settles a latent bug. Phase 4's marker check was a `return`,
not a skip, so on any hive carrying the marker phases 5 and 6 never ran
at all — the tool-group backfill, whose whole job was preventing a silent
privilege downgrade, has not executed here in a long time. Moving it to
create-time removes the question rather than answering it.

What stays is convergence: three unguarded, idempotent phases that re-run
each boot and no-op once their state is right. The module doc now names
the three categories so the next person can tell which kind they're
adding.

docs/persistence.md

@@ -324,11 +324,11 @@ Contents:
 
 The root agent has the meta dir RO-mounted at `/meta/`.
 
-Marker file `/var/lib/hyperhive/.meta-migration-done` is
-written by the startup migration after every container has
-been repointed at `meta#<n>`. Removing it forces a re-run on
-next hive-c0re start (idempotent — only the actual repoint
-step would re-fire).
+There is no longer a `.meta-migration-done` marker: the
+one-shot container repoint it guarded has been removed, since
+containers are rendered onto `meta#<n>` at creation. A stale
+marker file left over from an older hive is inert and can be
+deleted.
 
 ## Destroy vs purge