agent permissions: one set, tool groups included, set at agent creation

mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.

hive-c0re/src/coordinator.rs

@@ -552,52 +552,6 @@ impl Coordinator {
         });
     }
 
-    /// Best-effort synchronous snapshot of live container names (the
-    /// logical agent names from the last `nixos-container list` scan).
-    /// Returns `None` when the roster cache lock is momentarily
-    /// contended. The async `containers_snapshot` is the reliable path
-    /// for request handlers; this exists for the sync SSE snapshot emits.
-    #[must_use]
-    pub fn live_container_names_blocking(&self) -> Option<HashSet<String>> {
-        self.last_containers
-            .try_lock()
-            .ok()
-            .map(|m| m.keys().cloned().collect())
-    }
-
-    /// Emit a `ToolGroupsChanged` snapshot event. Called from the
-    /// rebuild-queue worker after a `PermChange` / `ToolGroups` entry
-    /// commits the JSON file, so the P3RM1SS10NS tab updates live.
-    pub fn emit_tool_groups_snapshot(self: &Arc<Self>) {
-        use hive_sh4re::permissions::ToolGroup;
-        let groups = ToolGroup::ALL.iter().map(|g| <&str>::from(*g)).collect();
-        let descriptions = ToolGroup::ALL
-            .iter()
-            .map(|g| (<&str>::from(*g), g.description()))
-            .collect();
-        let assignments = match crate::tool_groups::read() {
-            Ok(map) => map,
-            Err(e) => {
-                tracing::warn!(error = ?e, "tool-groups snapshot skipped");
-                return;
-            }
-        };
-        let roster = self.live_container_names_blocking().unwrap_or_default();
-        let (agents, effective) = crate::dashboard::permissions::roster_and_effective(
-            roster,
-            &assignments,
-            &crate::dashboard::permissions::tool_group_default_names(),
-        );
-        self.emit_dashboard_event(DashboardEvent::ToolGroupsChanged {
-            seq: self.next_seq(),
-            groups,
-            descriptions,
-            assignments,
-            agents,
-            effective,
-        });
-    }
-
     /// Subscribe to the shutdown watch channel. Background tasks call
     /// this at spawn time and break their loop when the receiver
     /// transitions to `true` (via `Coordinator::request_shutdown`).