agent permissions: one set, tool groups included, set at agent creation

mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.

docs/tools/swarmctl-cli.md

@@ -70,7 +70,7 @@ Manage agents across the swarm
 * `create` — Queue creation of a new agent on a hive in this swarm
 * `mint-forge-token` — Check one agent's forge token, and mint it if it's missing or stale
 * `inference` — Show the model, effort, subagent models and subagent cap the swarm sets for an agent, or change the model, effort and subagent models
-* `permissions` — Show or change the capabilities the swarm grants an agent
+* `permissions` — Show or change the permissions the swarm grants an agent
 
 
 
@@ -205,23 +205,23 @@ Clear every field for an agent, so it goes back to its own values
 
 ## `swarmctl agent permissions`
 
-Show or change the capabilities the swarm grants an agent.
+Show or change the permissions the swarm grants an agent.
 
-The hive running the agent reads them every 30 seconds and, when they change, restarts the agent after its current turn. Unset leaves the agent on its hive's default: none, except `ruth`, who gets `manage_root_agent`.
+The agent applies its tool permissions at its next turn; the hive running it restarts it, after its current turn, when `manage_root_agent` changes. Unset leaves the agent on the default: `messaging`, `meta`, `inbox`, `execution`, plus `manage_root_agent` for `ruth`.
 
 **Usage:** `swarmctl agent permissions <COMMAND>`
 
 ###### **Subcommands:**
 
-* `get` — Show the capabilities the swarm grants an agent, or that it sets none
-* `set` — Replace the capabilities the swarm grants an agent
-* `clear` — Clear the agent's permissions, so its hive's default applies again
+* `get` — Show the permissions the swarm grants an agent, or that it sets none
+* `set` — Replace the permissions the swarm grants an agent
+* `clear` — Clear the agent's permissions, so the default applies again
 
 
 
 ## `swarmctl agent permissions get`
 
-Show the capabilities the swarm grants an agent, or that it sets none
+Show the permissions the swarm grants an agent, or that it sets none
 
 **Usage:** `swarmctl agent permissions get [OPTIONS] <AGENT>`
 
@@ -239,9 +239,9 @@ Show the capabilities the swarm grants an agent, or that it sets none
 
 ## `swarmctl agent permissions set`
 
-Replace the capabilities the swarm grants an agent
+Replace the permissions the swarm grants an agent
 
-**Usage:** `swarmctl agent permissions set [OPTIONS] --capabilities <CAPABILITIES> <AGENT>`
+**Usage:** `swarmctl agent permissions set [OPTIONS] --permissions <PERMISSIONS> <AGENT>`
 
 ###### **Arguments:**
 
@@ -249,7 +249,7 @@ Replace the capabilities the swarm grants an agent
 
 ###### **Options:**
 
-* `--capabilities <CAPABILITIES>` — The capabilities to grant, comma-separated (`manage_root_agent`). `--capabilities ''` grants none
+* `--permissions <PERMISSIONS>` — The permissions to grant, comma-separated: any of `messaging`, `meta`, `inbox`, `execution`, `web_tools`, `manage_root_agent`. `--permissions ''` grants none
 * `--controller-socket <PATH>` — swarm-controller's unix socket.
 
    Supplied by the nix module that installs this binary, from the same `socketPath` option the daemon binds; falls back to `SWARM_CONTROLLER_SOCKET`.
@@ -258,7 +258,7 @@ Replace the capabilities the swarm grants an agent
 
 ## `swarmctl agent permissions clear`
 
-Clear the agent's permissions, so its hive's default applies again
+Clear the agent's permissions, so the default applies again
 
 **Usage:** `swarmctl agent permissions clear [OPTIONS] <AGENT>`