feat(#1086): serialize perm changes through rebuild queue

add QueueKind::PermChange — dashboard tool-group and capability
handlers no longer write the shared JSON files inline. instead they
enqueue a PermChange entry; the FIFO worker applies the file write
then calls rebuild_agent so the updated env var takes effect.

concurrent batch-apply actions for different agents previously raced
on tool-groups.json / capabilities.json (last write wins, earlier
change silently dropped). serialising through the queue prevents this.

dedup check extended with perm-type discriminant so tool-groups and
capabilities changes for the same agent are kept as distinct entries
and never collapse into one slot.

hive-c0re/src/tool_groups.rs

@@ -71,7 +71,7 @@ fn write(map: &BTreeMap<String, Vec<String>>) -> std::io::Result<()> {
 /// Validate a slice of group name strings against `ToolGroup::ALL`.
 /// Returns `Ok(())` when all names are known, or `Err` listing the
 /// unrecognised names so callers can surface a useful error message.
-fn validate_groups(groups: &[String]) -> anyhow::Result<()> {
+pub fn validate_groups(groups: &[String]) -> anyhow::Result<()> {
     let valid: std::collections::BTreeSet<&str> =
         hive_sh4re::ToolGroup::ALL.iter().map(|g| g.as_str()).collect();
     let unknown: Vec<&str> = groups