agent permissions: one set, tool groups included, set at agent creation

mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.

docs/agent-lifecycle/persistence.md

@@ -329,14 +329,14 @@ Under `/var/lib/hyperhive/agents/<name>/`:
 
 ### Cross-agent access to state
 
-An agent holding the `ManageRootAgent` capability gets every other
+An agent holding the `manage_root_agent` permission gets every other
 agent's `state` dir bind-mounted **read-write** and its `config` dir
 **read-only** (`bind_child_agent_dirs` in `lifecycle/host_config.rs`).
 The RW on `state` is deliberate, not an oversight: the holder recovers
 other agents, which includes writing into their state (for example
 seeding notes, clearing a stuck sentinel) as well as reading it.
 
-This is the **only** cross-agent mount. An agent holding no capability
+This is the **only** cross-agent mount. An agent without that permission
 sees its own dirs and nothing else.
 
 **`harness` isn't mounted at all.** It holds that agent's own runtime
@@ -364,7 +364,7 @@ mount should be writable when it shouldn't.
 <!-- vale write-good.Passive = YES -->
 
 Isolation still holds by default: a container has its *own* dirs and,
-unless it holds the capability, nothing else.
+unless it holds the permission, nothing else.
 
 Under `/var/lib/hyperhive/applied/<name>/` — the hive-c0re-only
 applied repo. Tracks `flake.nix` (module-only boilerplate; never
@@ -384,13 +384,9 @@ Contents:
   audit trail (one commit per successful deploy or hyperhive bump).
 - `topology.json` — the agent roster (`["alice", "bob", "ruth"]`).
   Written by `topology::reconcile` on every meta sync; read by
-  `topology::all_agents`, which is the set the `ManageRootAgent`
-  capability grants mounts over. The reader also accepts a map-shaped
+  `topology::all_agents`, which is the set the `manage_root_agent`
+  permission grants mounts over. The reader also accepts a map-shaped
   file carrying a `parent` per agent, and keeps its keys.
-- `tool-groups.json` — per-agent MCP tool group grants
-  (`{ "alice": ["messaging", "inbox", "execution"] }`). Written by
-  `tool_groups::set_groups`; injected as `HIVE_TOOL_GROUPS` env
-  var into each agent's container.
 - `swarm-resource-limits.json` — the caps the swarm sets for this
   hive's agents
   (`{ "sock": { "cpu_quota": "400%", "memory_max": "8G" } }`).
@@ -415,11 +411,11 @@ Contents:
 The root agent has the meta dir RO-mounted at `/meta/`.
 
 Outside the meta repo, `/var/lib/hyperhive/swarm-agent-permissions.json`
-holds the capabilities the swarm grants this hive's agents, as
+holds the permissions the swarm grants this hive's agents, as
 `workers::swarm_permissions` last read them from the swarm's
 `agent-permissions` bucket (every 30 seconds): a copy, not the
 record, which `swarmctl agent permissions` sets. `set_nspawn_flags`
-reads it at every container start.
+reads it at every container start for `manage_root_agent`.
 
 hive-c0re renders containers onto `meta#<n>` at creation.