config PRs: remove the hive's config-PR webhook, poll and core merge

An operator's merge on the forge deploys a config PR through
swarm-controller's DeployRequest{rev}. The hive-side path that queued a
MergeConfigPr approval and merged the PR as `core` goes:

- the `/webhook/config-pr` receiver, its HMAC secret, the WebhookRegister
  boot node and the org-hook registration; the hive vhost's `/webhook/`
  location
- the 5-minute config-PR poll
- ApprovalKind::MergeConfigPr, its dashboard card, and the deploy DAG it
  drove (DeployWindow, MergeVerify, DeployApply, FinalizeDeploy,
  DeployTail), with verify_commit, the two-phase meta deploy, rollback
  refs, the PR-failure comment and forge/pr_merge.rs
- `fetched_sha`, `sha_short`/`pr_number` on approval events, and
  `sha`/`tag` on HelperEvent::ApprovalResolved: only the merge path set
  them

`config_repo`, `merged_pr_for_commit` and `post_pr_comment` move to
forge/pr_comment.rs for the merged-rev deploy's refusal comment.
Approvals v5 drops stored `merge_config_pr` rows; a test reopens a v4
database holding them.

Closes #4850

hive-c0re/src/job_queue/model.rs

@@ -102,28 +102,11 @@ pub enum NodeKind {
     WriteDropin { agent: String },
     /// Commit `tool-groups.json` / `capabilities.json` per its `payload`.
     WritePermFile { agent: String, payload: PermPayload },
-    /// Group root of the approval-deploy (`MergeConfigPr`) subtree — the
-    /// **brace** that owns the deploy window. See _Braces_ and _Approvals_.
-    DeployWindow { agent: String, approval_id: i64 },
     /// Group root of a rebuild subtree — the **brace**, scoped to one
     /// agent. Why braces exist and what they cost: _Braces_.
     AgentWindow { agent: String },
-    /// Deploy phase 1 — **verify only, mutates nothing.**
-    MergeVerify { agent: String, approval_id: i64 },
-    /// Deploy phase 2 — the irreversible fast-forward plus the *opening*
-    /// half of the two-phase meta deploy. Does **not** build the container
-    /// itself; grows the ordinary rebuild subgraph in as its own children
-    /// (see the rebuild-path section's approval-deploy paragraph).
-    DeployApply { agent: String, approval_id: i64 },
-    /// Deploy phase 3 — closes the two-phase meta deploy once
-    /// [`NodeKind::DeployApply`]'s rebuild subgraph comes up clean.
-    FinalizeDeploy { agent: String, approval_id: i64 },
-    /// Deploy compensation **and bookkeeping** tail. See the `DeployTail`
-    /// node-inventory row for its three responsibilities and why it isn't
-    /// named `AbortDeploy`.
-    DeployTail { agent: String, approval_id: i64 },
-    /// Tail node of an approval-carrying DAG (opaque deploy /
-    /// config-PR merge): resolve the approval row from how the work ended.
+    /// Tail node of an approval-carrying DAG (a meta-inputs update): resolve
+    /// the approval row from how the work ended.
     ResolveApproval {
         approval_id: i64,
         /// Which outcome this node reports. A template emits **one per
@@ -147,8 +130,6 @@ pub enum NodeKind {
     /// Matrix user/space sweep (`matrix::ensure_all`): at boot and every 30
     /// minutes. Agentless.
     MatrixSweep,
-    /// One-shot boot-time Forgejo webhook registration. Agentless.
-    WebhookRegister,
     /// `/knowledge` pull (`knowledge::pull`): at boot, on the swarm
     /// knowledge-changed event, and hourly. Agentless.
     KnowledgePull,
@@ -174,9 +155,6 @@ impl hive_jobq_wire::WireNode for NodeKind {
         if !agent.is_empty() {
             data.insert("agent".to_owned(), agent.into());
         }
-        if let NodeKind::DeployWindow { approval_id, .. } = self {
-            data.insert("approval_id".to_owned(), (*approval_id).into());
-        }
         if let NodeKind::MetaLock { inputs, .. } = self
             && !inputs.is_empty()
         {
@@ -221,19 +199,13 @@ impl NodeKind {
             | NodeKind::PauseDrain { agent }
             | NodeKind::WriteDropin { agent }
             | NodeKind::WritePermFile { agent, .. }
-            | NodeKind::DeployWindow { agent, .. }
             | NodeKind::AgentWindow { agent }
-            | NodeKind::MergeVerify { agent, .. }
-            | NodeKind::DeployApply { agent, .. }
-            | NodeKind::FinalizeDeploy { agent, .. }
-            | NodeKind::DeployTail { agent, .. }
             | NodeKind::EmitRebuilt { agent, .. }
             | NodeKind::SetWanted { agent, .. } => agent,
             NodeKind::MetaLock { .. }
             | NodeKind::ResolveApproval { .. }
             | NodeKind::ForgeSweep
             | NodeKind::MatrixSweep
-            | NodeKind::WebhookRegister
             | NodeKind::KnowledgePull
             | NodeKind::WantedPull => "",
         }
@@ -280,8 +252,8 @@ impl NodeKind {
         //   bug, and a `true` here would suppress the alert that says so.
         // - `Reconcile` is a planner; it fans out `Start` / `Stop`, which carry
         //   their own answer.
-        // - `DeployWindow` brackets a deploy without itself stopping anything.
-        // - `AgentWindow` likewise, though it *parents* nodes that answer
+        // - `AgentWindow` brackets a rebuild without itself stopping anything,
+        //   though it *parents* nodes that answer
         //   `true`. This is per-node, not per-subtree, and each of those
         //   children reports for itself — so `true` here would only widen
         //   suppression over the build and tail, where a vanished container is