agent permissions: one set, tool groups included, set at agent creation

mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.

frontend/packages/dashboard/src/dashboard.css

@@ -566,107 +566,6 @@ footer .banner-thin {
   margin-bottom: 0.8em;
 }
 
-/* ─── tool-groups (permissions) table ──────────────────────────────
-   Agents × tool-groups matrix in the P3RM1SS10NS tab. Horizontally
-   scrollable on narrow viewports. */
-.tg-table-wrap {
-  overflow-x: auto;
-  margin-top: 0.5em;
-}
-.tg-table {
-  border-collapse: collapse;
-  font-size: 0.82em;
-  min-width: 100%;
-}
-.tg-table th,
-.tg-table td {
-  padding: 0.35em 0.6em;
-  border: 1px solid var(--border);
-  text-align: center;
-  vertical-align: middle;
-}
-.tg-table thead th {
-  background: var(--bg-elev);
-  color: var(--muted);
-  letter-spacing: 0.05em;
-  white-space: nowrap;
-}
-.tg-agent-col {
-  text-align: left !important;
-  min-width: 8em;
-}
-.tg-group-col {
-  min-width: 5em;
-}
-.tg-agent-name {
-  color: var(--fg);
-  font-weight: 600;
-}
-.tg-cb {
-  cursor: pointer;
-  width: 1em;
-  height: 1em;
-  accent-color: var(--purple);
-}
-.tg-row:hover td {
-  background: var(--bg-elev);
-}
-
-/* ─── permissions save bar (save-all) ──────────────────────────────
-   One page-level save button for the whole P3RM1SS10NS tab. Sticks to
-   the bottom of the pane so it stays reachable while scrolling a long
-   agent×perm matrix. Disabled (dim) until an edit makes the page dirty;
-   the (N agents) count in the label reflects how many agents will
-   rebuild. `#perm-save-note` carries the transient rebuilding/error
-   line beside it. */
-.perm-save-bar {
-  position: sticky;
-  bottom: 0;
-  display: flex;
-  align-items: center;
-  gap: 0.8em;
-  margin-top: 1em;
-  padding: 0.7em 0;
-  background: var(--bg);
-  border-top: 1px solid var(--border);
-}
-.perm-save-bar .btn:disabled {
-  opacity: 0.45;
-  cursor: not-allowed;
-}
-.perm-save-err {
-  color: var(--red);
-}
-
-/* Stale permission entry (agent not in the live roster) */
-.perm-row-stale td {
-  opacity: 0.7;
-}
-.perm-stale-label {
-  font-size: 0.75em;
-  color: var(--muted);
-  margin-left: 0.4em;
-}
-.perm-remove-btn {
-  margin-left: 0.5em;
-  padding: 0.05em 0.5em;
-  font-size: 0.75em;
-  color: var(--red);
-  background: transparent;
-  border: 1px solid currentColor;
-  border-radius: 3px;
-  cursor: pointer;
-  font-family: inherit;
-  opacity: 0.8;
-}
-.perm-remove-btn:hover {
-  opacity: 1;
-}
-.perm-remove-btn:disabled {
-  opacity: 0.4;
-  cursor: not-allowed;
-}
-
 /* Selection bar — sticky-bottom strip for bulk actions. */
 .selection-bar {
   position: fixed;