agent permissions: one set, tool groups included, set at agent creation

mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.

hive-c0re/src/dashboard_events.rs

@@ -141,24 +141,6 @@ pub enum DashboardEvent {
     /// (transients, container state), and a poll loop would be
     /// slower for the same information.
     RebuildQueueChanged { seq: u64 },
-    /// Full snapshot of tool-group assignments (per-agent `Vec<group_name>`).
-    /// Emitted from the rebuild-queue worker after a `PermChange`
-    /// `ToolGroups` entry commits the JSON file. Lets the P3RM1SS10NS
-    /// tab update live when the worker applies a queued change.
-    ToolGroupsChanged {
-        seq: u64,
-        /// Ordered list of all known tool-group names (column headers).
-        groups: Vec<&'static str>,
-        /// Short description for each group name (tooltip).
-        descriptions: std::collections::BTreeMap<&'static str, &'static str>,
-        /// Per-agent *explicit* assignment map; absent agents use the role
-        /// default (the UI badges those "(default)").
-        assignments: std::collections::BTreeMap<String, Vec<String>>,
-        /// Sorted roster the operator can manage (live ∪ explicit keys).
-        agents: Vec<String>,
-        /// Per-agent *effective* groups (explicit-or-`AGENT_DEFAULT`).
-        effective: std::collections::BTreeMap<String, Vec<String>>,
-    },
 }
 
 impl DashboardEvent {
@@ -185,7 +167,6 @@ impl DashboardEvent {
             DashboardEvent::MetaInputsChanged { .. } => "meta_inputs_changed",
             DashboardEvent::MetaUpdateRunning { .. } => "meta_update_running",
             DashboardEvent::RebuildQueueChanged { .. } => "rebuild_queue_changed",
-            DashboardEvent::ToolGroupsChanged { .. } => "tool_groups_changed",
         }
     }
 }
@@ -260,14 +241,6 @@ mod tests {
                 running: false,
             },
             DashboardEvent::RebuildQueueChanged { seq: 1 },
-            DashboardEvent::ToolGroupsChanged {
-                seq: 1,
-                groups: Vec::new(),
-                descriptions: std::collections::BTreeMap::new(),
-                assignments: std::collections::BTreeMap::new(),
-                agents: Vec::new(),
-                effective: std::collections::BTreeMap::new(),
-            },
         ];
         for ev in samples {
             let v: serde_json::Value = serde_json::to_value(&ev).expect("serialise");