agent permissions: one set, tool groups included, set at agent creation

mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.

docs/agent-lifecycle/agent-roster.md

@@ -2,8 +2,8 @@
 
 <!-- vale write-good.Passive = NO -->
 
-Agents are a **flat set**: the capability store scopes which agents can
-manage which others.
+Agents are a **flat set**: the `manage_root_agent` permission scopes
+which agents can manage which others.
 
 <!-- vale write-good.Passive = YES -->
 
@@ -79,7 +79,7 @@ module docs for the exact call chain.
 ## Hard-coded manager behaviour
 
 The **manager (`ruth`)** differs from other agents in naming/bootstrap,
-its socket flavour and its default capability grant; its prompt, tool
+its socket flavour and its default permissions; its prompt, tool
 allow-list and state dirs work as for every other agent. A hive with
 `services.hyperhive.ruthless = true` runs no manager: `hive-c0re` skips
 its root-agent create/start sweep
@@ -107,7 +107,7 @@ apply.
   manage any agent's state dir — config isn't authored there, since a
   real config change is a PR from a clone), plus RO mounts for
   `/applied` (diff against what's deployed) and `/meta` (system-wide
-  deploy log). That grant is the `ManageRootAgent` capability: ruth
+  deploy log). That grant is the `manage_root_agent` permission: ruth
   holds it by default, and any agent holding it gets the same mounts.
   The operator dashboard's `POST /api/meta-update` is the only path
   that writes `flake.lock`.
@@ -118,11 +118,10 @@ apply.
   `hive-agent/src/prompt.rs`'s own module doc). The `role:manager`
   blocks are dead in production, exercised only by a unit test
   (`filter_role_blocks(SAMPLE, "manager")`).
-- **Tool allow-list** — the MCP tools claude sees come from
-  `HIVE_TOOL_GROUPS` alone, the same mechanism for every agent
-  ([`docs/turn-loop/mcp.md`](../turn-loop/mcp.md)). Ruth's wider default
-  surface is a wider default grant (`ToolGroup::MANAGER_DEFAULT`, seeded
-  by `auto_update.rs` whenever its groups aren't already set).
+- **Tool allow-list** — the MCP tools claude sees come from the agent's
+  permissions alone, the same mechanism for every agent
+  ([`docs/turn-loop/mcp.md`](../turn-loop/mcp.md)). Ruth's default
+  permissions add only `manage_root_agent` (`Permission::default_for`).
 - **State dirs** — _not_ special-cased: `HYPERHIVE_STATE_DIR` is
 injected uniformly via `systemd.globalEnvironment` for every
 container including the manager, so all token/state paths resolve