config PRs: remove the hive's config-PR webhook, poll and core merge

An operator's merge on the forge deploys a config PR through
swarm-controller's DeployRequest{rev}. The hive-side path that queued a
MergeConfigPr approval and merged the PR as `core` goes:

- the `/webhook/config-pr` receiver, its HMAC secret, the WebhookRegister
  boot node and the org-hook registration; the hive vhost's `/webhook/`
  location
- the 5-minute config-PR poll
- ApprovalKind::MergeConfigPr, its dashboard card, and the deploy DAG it
  drove (DeployWindow, MergeVerify, DeployApply, FinalizeDeploy,
  DeployTail), with verify_commit, the two-phase meta deploy, rollback
  refs, the PR-failure comment and forge/pr_merge.rs
- `fetched_sha`, `sha_short`/`pr_number` on approval events, and
  `sha`/`tag` on HelperEvent::ApprovalResolved: only the merge path set
  them

`config_repo`, `merged_pr_for_commit` and `post_pr_comment` move to
forge/pr_comment.rs for the merged-rev deploy's refusal comment.
Approvals v5 drops stored `merge_config_pr` rows; a test reopens a v4
database holding them.

Closes #4850

hive-c0re/src/paths.rs

@@ -59,31 +59,12 @@ pub fn db_dir() -> PathBuf {
     state_root().join("db")
 }
 
-/// `webhook-secret` — hex-encoded 32-byte HMAC secret shared between
-/// hive-c0re's webhook handlers and the Forgejo webhook registrations.
-/// Generated on first startup and persisted. The config-PR hook is replaced
-/// at the next boot-time registration when this no longer matches
-/// [`forge_config_pr_webhook_fingerprint`].
-#[must_use]
-pub fn webhook_secret_file() -> PathBuf {
-    state_root().join("webhook-secret")
-}
-
 /// `forge/` — hive-c0re's own forge provisioning markers.
 #[must_use]
 pub fn forge_dir() -> PathBuf {
     state_root().join("forge")
 }
 
-/// `forge/config-pr-webhook-secret-sha256` — SHA-256 of the webhook secret
-/// the config-PR hook was last registered with. Forgejo never returns a
-/// hook's secret, so this is the only record of which one it signs with;
-/// delete to force the hook to be replaced.
-#[must_use]
-pub fn forge_config_pr_webhook_fingerprint() -> PathBuf {
-    forge_dir().join("config-pr-webhook-secret-sha256")
-}
-
 /// `forge/core-avatar-set` — marker: core account avatar uploaded.
 #[must_use]
 pub fn forge_core_avatar_marker() -> PathBuf {