config PRs: remove the hive's config-PR webhook, poll and core merge

An operator's merge on the forge deploys a config PR through
swarm-controller's DeployRequest{rev}. The hive-side path that queued a
MergeConfigPr approval and merged the PR as `core` goes:

- the `/webhook/config-pr` receiver, its HMAC secret, the WebhookRegister
  boot node and the org-hook registration; the hive vhost's `/webhook/`
  location
- the 5-minute config-PR poll
- ApprovalKind::MergeConfigPr, its dashboard card, and the deploy DAG it
  drove (DeployWindow, MergeVerify, DeployApply, FinalizeDeploy,
  DeployTail), with verify_commit, the two-phase meta deploy, rollback
  refs, the PR-failure comment and forge/pr_merge.rs
- `fetched_sha`, `sha_short`/`pr_number` on approval events, and
  `sha`/`tag` on HelperEvent::ApprovalResolved: only the merge path set
  them

`config_repo`, `merged_pr_for_commit` and `post_pr_comment` move to
forge/pr_comment.rs for the merged-rev deploy's refusal comment.
Approvals v5 drops stored `merge_config_pr` rows; a test reopens a v4
database holding them.

Closes #4850

hive-c0re/src/dashboard/state_snapshot.rs

@@ -131,8 +131,7 @@ struct ApprovalHistoryView {
     id: i64,
     agent: String,
     kind: &'static str,
-    /// First 12 chars of the canonical sha (preferred) or
-    /// manager-supplied ref. None when the approval carries neither.
+    /// First 12 chars of the manager-supplied ref. None when it is empty.
     sha_short: Option<String>,
     /// `approved` / `denied` / `failed`.
     status: &'static str,
@@ -149,25 +148,14 @@ struct ApprovalView {
     id: i64,
     agent: String,
     kind: &'static str,
-    /// First 12 chars of the reviewed PR head sha, for `MergeConfigPr`
-    /// only. Display-only (the short chip on the card).
-    sha_short: Option<String>,
     /// Manager-supplied description shown on the approval card.
     #[serde(skip_serializing_if = "Option::is_none")]
     description: Option<String>,
-    /// Forge PR number, for `MergeConfigPr` only. Lets the frontend
-    /// build a "review PR on forge" link
-    /// (`{forgeBase}/agent-configs/{agent}/pulls/{pr_number}`). `None`
-    /// for every other kind.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pr_number: Option<u64>,
     /// Raw `commit_ref` payload for `UpdateMetaInputs` (JSON-encoded
     /// `Vec<String>` of input names; `"[]"` = all inputs) and
     /// `SchedulePrompt` (JSON-encoded `SchedulePromptPayload`). The
     /// frontend parses this to render a human-readable card body.
-    /// `None` for every other kind.
-    #[serde(skip_serializing_if = "Option::is_none")]
-    commit_ref: Option<String>,
+    commit_ref: String,
     /// RFC 3339 UTC time the approval was queued. Rendered as a
     /// relative time on the card so the operator can spot a stale
     /// request.
@@ -388,13 +376,11 @@ fn build_transient_views(
     out
 }
 
-/// Render each pending approval into its dashboard view (short sha for
-/// `MergeConfigPr`).
 /// Project a resolved sqlite row into the lean shape the dashboard
 /// history tab consumes — no `diff_html` (rendering 30 of them
 /// per /api/state poll would mean 30 git diffs per refresh).
 fn history_view(a: Approval) -> ApprovalHistoryView {
-    let displayed = a.fetched_sha.as_deref().unwrap_or(&a.commit_ref);
+    let displayed = a.commit_ref.as_str();
     let sha_short = if displayed.is_empty() {
         None
     } else {
@@ -421,54 +407,17 @@ fn history_view(a: Approval) -> ApprovalHistoryView {
 }
 
 fn build_approval_views(approvals: Vec<Approval>) -> Vec<ApprovalView> {
-    let mut out = Vec::with_capacity(approvals.len());
-    for a in approvals {
-        out.push(match a.kind {
-            hive_sh4re::approvals::ApprovalKind::UpdateMetaInputs => ApprovalView {
-                id: a.id,
-                agent: a.agent.to_string(),
-                kind: "update_meta_inputs",
-                sha_short: None,
-                description: a.description,
-                pr_number: None,
-                commit_ref: Some(a.commit_ref),
-                requested_at: a.requested_at,
-            },
-            hive_sh4re::approvals::ApprovalKind::SchedulePrompt => ApprovalView {
-                id: a.id,
-                agent: a.agent.to_string(),
-                kind: "schedule_prompt",
-                sha_short: None,
-                description: a.description,
-                pr_number: None,
-                commit_ref: Some(a.commit_ref),
-                requested_at: a.requested_at,
-            },
-            hive_sh4re::approvals::ApprovalKind::MergeConfigPr => {
-                // commit_ref = PR number; fetched_sha = the reviewed PR
-                // head. Show the head sha; the config diff surface lives
-                // on the forge PR itself.
-                let sha = a
-                    .fetched_sha
-                    .as_deref()
-                    .map(|s| s[..s.len().min(12)].to_owned());
-                // Surface the PR number so the frontend can link to the
-                // PR on the forge. commit_ref holds the number as text.
-                let pr_number = a.commit_ref.parse::<u64>().ok();
-                ApprovalView {
-                    id: a.id,
-                    agent: a.agent.to_string(),
-                    kind: "merge_config_pr",
-                    sha_short: sha,
-                    description: a.description,
-                    pr_number,
-                    commit_ref: None,
-                    requested_at: a.requested_at,
-                }
-            }
-        });
-    }
-    out
+    approvals
+        .into_iter()
+        .map(|a| ApprovalView {
+            id: a.id,
+            agent: a.agent.to_string(),
+            kind: <&str>::from(a.kind),
+            description: a.description,
+            commit_ref: a.commit_ref,
+            requested_at: a.requested_at,
+        })
+        .collect()
 }
 
 /// `/api/jobq/graph` query string — the generic jobq/wire query shape (any