config PRs: remove the hive's config-PR webhook, poll and core merge

An operator's merge on the forge deploys a config PR through
swarm-controller's DeployRequest{rev}. The hive-side path that queued a
MergeConfigPr approval and merged the PR as `core` goes:

- the `/webhook/config-pr` receiver, its HMAC secret, the WebhookRegister
  boot node and the org-hook registration; the hive vhost's `/webhook/`
  location
- the 5-minute config-PR poll
- ApprovalKind::MergeConfigPr, its dashboard card, and the deploy DAG it
  drove (DeployWindow, MergeVerify, DeployApply, FinalizeDeploy,
  DeployTail), with verify_commit, the two-phase meta deploy, rollback
  refs, the PR-failure comment and forge/pr_merge.rs
- `fetched_sha`, `sha_short`/`pr_number` on approval events, and
  `sha`/`tag` on HelperEvent::ApprovalResolved: only the merge path set
  them

`config_repo`, `merged_pr_for_commit` and `post_pr_comment` move to
forge/pr_comment.rs for the merged-rev deploy's refusal comment.
Approvals v5 drops stored `merge_config_pr` rows; a test reopens a v4
database holding them.

Closes #4850

hive-c0re/src/coordinator.rs

@@ -421,7 +421,6 @@ pub struct ApprovalResolved<'a> {
     pub id: i64,
     pub agent: &'a str,
     pub approval_kind: &'static str,
-    pub sha_short: Option<String>,
     pub status: &'static str,
     pub note: Option<String>,
     pub description: Option<String>,
@@ -430,14 +429,12 @@ pub struct ApprovalResolved<'a> {
 /// Field-named payload for [`Coordinator::emit_approval_added`].
 /// Mirrors the `ApprovalAdded` dashboard-event fields. `agent`
 /// borrows from the caller; `approval_kind` is a compile-time
-/// constant. `pr_number` is set for `merge_config_pr` only.
+/// constant.
 pub struct ApprovalAdded<'a> {
     pub id: i64,
     pub agent: &'a str,
     pub approval_kind: &'static str,
-    pub sha_short: Option<String>,
     pub description: Option<String>,
-    pub pr_number: Option<u64>,
 }
 
 /// The two ways [`Coordinator::set_paused_by_name`] can fail. See its own
@@ -782,18 +779,14 @@ impl Coordinator {
             id,
             agent,
             approval_kind,
-            sha_short,
             description,
-            pr_number,
         } = ev;
         self.emit_dashboard_event(DashboardEvent::ApprovalAdded {
             seq: self.next_seq(),
             id,
             agent: agent.to_owned(),
             approval_kind,
-            sha_short,
             description,
-            pr_number,
         });
     }
 
@@ -811,7 +804,6 @@ impl Coordinator {
             id,
             agent,
             approval_kind,
-            sha_short,
             status,
             note,
             description,
@@ -826,7 +818,6 @@ impl Coordinator {
             id,
             agent: agent.to_owned(),
             approval_kind,
-            sha_short,
             status,
             resolved_at: hive_sh4re::wire_time::from_secs(resolved_at),
             note,
@@ -1256,24 +1247,6 @@ impl Coordinator {
         }
     }
 
-    /// `push_todo` to whichever agent submitted approval `approval_id` —
-    /// same resolution `notify_submitter` uses. Every caller here is a
-    /// one-shot approval-resolution notice, so `reopen_if_acked` is
-    /// unconditionally `false` — there's no reconciler/event distinction
-    /// to make for an event that only ever fires once.
-    pub async fn push_todo_submitter(
-        &self,
-        approval_id: i64,
-        subsystem: &str,
-        key: Option<String>,
-        summary: String,
-        source: Option<String>,
-    ) -> Result<(), String> {
-        let target = self.submitter_or_manager(approval_id);
-        self.push_todo(&target, subsystem, key, summary, source, false)
-            .await
-    }
-
     /// Push a `HelperEvent` into an arbitrary agent's inbox. Encoded
     /// the same way as `notify_manager` (sender = `SYSTEM_SENDER`,
     /// body = JSON-encoded event) — e.g. `ContainerCrash`, `NeedsUpdate`.
@@ -1476,11 +1449,9 @@ impl Coordinator {
     }
 }
 
-/// `push_todo`/`push_todo_submitter` summary text for a rebuild outcome —
-/// shared by the two `Rebuilt` call sites (`actions::finish_approval`'s
-/// `MergeConfigPr` arm, `job_queue::exec::run_emit_rebuilt`) so the wording
-/// stays identical regardless of which path fired. Pure + independently
-/// testable, unlike the old `HelperEvent::Rebuilt`'s separate `sha`/`tag`
+/// `push_todo` summary text for a rebuild outcome, for
+/// `job_queue::exec::run_emit_rebuilt`. Pure + independently testable, unlike
+/// the old `HelperEvent::Rebuilt`'s separate `sha`/`tag`
 /// fields — those become part of the summary text itself now, since a todo
 /// carries one string, not a structured payload.
 #[must_use]