agent permissions: one set, tool groups included, set at agent creation

mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.

frontend/packages/dashboard/src/tabs.js

@@ -16,11 +16,6 @@ import { el } from "@hive/shared/dom.js";
 import { bindAsyncForms } from "@hive/shared/forms.js";
 import { createTabStrip } from "@hive/shared/tabs.js";
 import { containersState, syncContainersFromSnapshot } from "./state.js";
-import {
-  applyToolGroupsChanged,
-  fetchAndRenderToolGroups,
-  initPermissions,
-} from "./permissions.js";
 import {
   initJobqRollup,
   syncTransientsFromSnapshot,
@@ -59,11 +54,7 @@ window.marked = marked;
   // Sections whose innerHTML gets blown away on each refresh. If the
   // operator is typing in one of them, skip the refresh — the next
   // tick (or a manual action) will pick it up after they blur.
-  const MANAGED_SECTION_IDS = [
-    "containers-section",
-    "inbox-section",
-    "tool-groups-section",
-  ];
+  const MANAGED_SECTION_IDS = ["containers-section", "inbox-section"];
   // <details> sections that should survive a refresh need a stable
   // `data-restore-key` attribute. snapshotOpenDetails walks managed
   // sections and records which keys are currently open; restoreOpenDetails
@@ -207,7 +198,6 @@ window.marked = marked;
     },
     meta_inputs_changed: onMetaInputsChanged,
     meta_update_running: onMetaUpdateRunning,
-    tool_groups_changed: applyToolGroupsChanged,
   };
   (function bindDashboardStream() {
     // Route through the SharedWorker so all open hyperhive tabs on the
@@ -218,13 +208,12 @@ window.marked = marked;
     // fallback when SharedWorker isn't supported.
     //
     // kinds= matches MUTATION_HANDLERS verbatim, so the stream carries
-    // only the 9 wire kinds this page acts on.
+    // only the 7 wire kinds this page acts on.
     const es = openStream(
       "/api/dashboard/stream?kinds=" +
         "transient_set,transient_cleared," +
         "container_state_changed,container_removed,rebuild_queue_changed," +
-        "meta_inputs_changed,meta_update_running," +
-        "tool_groups_changed",
+        "meta_inputs_changed,meta_update_running",
     );
     es.onmessage = (e) => {
       let ev;
@@ -256,8 +245,8 @@ window.marked = marked;
   })();
 
   // ─── tab routing ───────────────────────────────────────────────────────
-  // Hash-based: `#agents` / `#rebuild` / `#meta` / `#buildlogs` /
-  // `#permissions` activate the matching pane on the dashboard. Empty
+  // Hash-based: `#agents` / `#rebuild` / `#meta` / `#buildlogs`
+  // activate the matching pane on the dashboard. Empty
   // hash defaults to 4G3NTS. FL0W and ST4TS are NOT tabs —
   // they're separate pages (`/flow.html`, `/stats.html`) reached from
   // the H0M3 hub. Tab routing only
@@ -274,14 +263,6 @@ window.marked = marked;
     // visibility (bar only belongs on 4G3NTS where agent cards live).
     document.body.dataset.activeTab = target;
     renderSelectionBar(Array.from(containersState.values()));
-    // Permissions table: SSE covers worker-applied changes
-    // (tool_groups_changed); re-fetch on
-    // activation as a safety net for any gap between SSE events and
-    // the cold-load snapshot.
-    if (target === "permissions") {
-      initPermissions();
-      fetchAndRenderToolGroups();
-    }
     onBuildsTabShown(target);
   }