config PRs: remove the hive's config-PR webhook, poll and core merge

An operator's merge on the forge deploys a config PR through
swarm-controller's DeployRequest{rev}. The hive-side path that queued a
MergeConfigPr approval and merged the PR as `core` goes:

- the `/webhook/config-pr` receiver, its HMAC secret, the WebhookRegister
  boot node and the org-hook registration; the hive vhost's `/webhook/`
  location
- the 5-minute config-PR poll
- ApprovalKind::MergeConfigPr, its dashboard card, and the deploy DAG it
  drove (DeployWindow, MergeVerify, DeployApply, FinalizeDeploy,
  DeployTail), with verify_commit, the two-phase meta deploy, rollback
  refs, the PR-failure comment and forge/pr_merge.rs
- `fetched_sha`, `sha_short`/`pr_number` on approval events, and
  `sha`/`tag` on HelperEvent::ApprovalResolved: only the merge path set
  them

`config_repo`, `merged_pr_for_commit` and `post_pr_comment` move to
forge/pr_comment.rs for the merged-rev deploy's refusal comment.
Approvals v5 drops stored `merge_config_pr` rows; a test reopens a v4
database holding them.

Closes #4850

hive-c0re/src/forge/pr_comment.rs

@@ -0,0 +1,56 @@
+//! Commenting on an agent's config PRs as the core forge user — how a hive
+//! reports a merged config commit it refused to deploy back onto the PR that
+//! merged it.
+
+use anyhow::{Context, Result};
+
+use super::{CONFIG_ORG, api, core_token};
+
+/// Full `owner/name` path of an agent's config repo on the forge.
+pub fn config_repo(agent: &str) -> String {
+    format!("{CONFIG_ORG}/{agent}")
+}
+
+/// The number of the merged PR that put commit `sha` on `repo`'s base branch.
+///
+/// # Errors
+/// Absent core token, malformed repo, no such PR, or transport/API failure.
+pub async fn merged_pr_for_commit(repo: &str, sha: &str) -> Result<u64> {
+    let token = core_token().context("forge core token absent")?;
+    let (owner, name) = repo
+        .split_once('/')
+        .with_context(|| format!("forge repo `{repo}` is not owner/name"))?;
+    let pull = api(&token)?
+        .repo_get_commit_pull_request(owner, name, sha)
+        .await
+        .context("GET pull request of commit")?;
+    pull.number
+        .and_then(|n| u64::try_from(n).ok())
+        .with_context(|| format!("pull request of {sha} in {repo} carries no number"))
+}
+
+/// Post a comment to PR (= issue) `pr` on `repo` as the core forge user.
+/// PRs are issues in Forgejo, so the PR number is the issue index.
+///
+/// # Errors
+/// Absent core token, malformed repo, or transport/API failure.
+pub async fn post_pr_comment(repo: &str, pr: u64, body: &str) -> Result<()> {
+    let token = core_token().context("forge core token absent")?;
+    let (owner, name) = repo
+        .split_once('/')
+        .with_context(|| format!("forge repo `{repo}` is not owner/name"))?;
+    let index = i64::try_from(pr).with_context(|| format!("PR index {pr} overflows i64"))?;
+    api(&token)?
+        .issue_create_comment(
+            owner,
+            name,
+            index,
+            forgejo_api::structs::CreateIssueCommentOption {
+                body: body.to_owned(),
+                updated_at: None,
+            },
+        )
+        .await
+        .context("post PR comment")?;
+    Ok(())
+}