config PRs: remove the hive's config-PR webhook, poll and core merge

An operator's merge on the forge deploys a config PR through
swarm-controller's DeployRequest{rev}. The hive-side path that queued a
MergeConfigPr approval and merged the PR as `core` goes:

- the `/webhook/config-pr` receiver, its HMAC secret, the WebhookRegister
  boot node and the org-hook registration; the hive vhost's `/webhook/`
  location
- the 5-minute config-PR poll
- ApprovalKind::MergeConfigPr, its dashboard card, and the deploy DAG it
  drove (DeployWindow, MergeVerify, DeployApply, FinalizeDeploy,
  DeployTail), with verify_commit, the two-phase meta deploy, rollback
  refs, the PR-failure comment and forge/pr_merge.rs
- `fetched_sha`, `sha_short`/`pr_number` on approval events, and
  `sha`/`tag` on HelperEvent::ApprovalResolved: only the merge path set
  them

`config_repo`, `merged_pr_for_commit` and `post_pr_comment` move to
forge/pr_comment.rs for the merged-rev deploy's refusal comment.
Approvals v5 drops stored `merge_config_pr` rows; a test reopens a v4
database holding them.

Closes #4850

hive-c0re/src/lifecycle/setup.rs

@@ -98,8 +98,8 @@ async fn ensure_applied_remote(proposed_dir: &Path, name: &str) -> Result<()> {
 /// Set up the applied repo. First-spawn only: init the repo, pull
 /// proposed's initial commit in via `git fetch`, tag it `deployed/0`.
 /// This is the *only* time hive-c0re reads from `proposed` for an
-/// agent — subsequent config changes are fetched from the reviewed
-/// forge PR head at merge time (see `actions::run_deploy_apply`).
+/// agent — subsequent config changes are fetched from the forge's `main`
+/// (see `actions::advance_applied_to_rev`).
 ///
 /// `proposed_dir` is `None` on rebuild paths where the repo already
 /// exists — we just verify it's the right shape and bail otherwise.