agent permissions: one set, tool groups included, set at agent creation

mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.

hive-c0re/src/lifecycle/host_config.rs

@@ -7,7 +7,7 @@ use std::path::{Path, PathBuf};
 
 use anyhow::{Context, Result};
 use hive_priv_sock::{BindMount, CredentialMount};
-use hive_sh4re::permissions::Capability;
+use hive_sh4re::permissions::Permission;
 
 use crate::coordinator::{AgentPaths, HiveEnv};
 
@@ -386,7 +386,7 @@ fn bind_own_agent_dirs(agent_name: &str, notes_dir: &Path, binds: &mut Vec<BindM
 /// agent starts without the cross-agent mounts, so one corrupt file never
 /// blocks any agent's start, spawn or swap.
 fn holds_manage_root_agent(agent_name: &str, path: &Path) -> bool {
-    crate::capabilities::holds(path, agent_name, Capability::ManageRootAgent).unwrap_or_else(|e| {
+    crate::permissions::holds(path, agent_name, Permission::ManageRootAgent).unwrap_or_else(|e| {
         tracing::error!(
             agent = %agent_name,
             path = %path.display(),
@@ -567,25 +567,25 @@ async fn set_nspawn_flags(
         read_only: true,
     });
 
-    // `ManageRootAgent` capability: mount *every* agent in the hive as a
+    // `ManageRootAgent` permission: mount *every* agent in the hive as a
     // virtual child. Enables recovery — the holder can update another
     // agent's config even when that agent is down. Also grants RO access
     // to /applied and /meta.
     //
-    // ⚠️ "every agent" is the definition of this capability, not an
+    // ⚠️ "every agent" is the definition of this permission, not an
     // accident of how the set is computed. The grant used to hang off a
     // `can_manage_top_level_agents` role and cover `top_level_agents()`
     // — i.e. `parent.is_none()` — which was "everything outside the
     // hierarchy". With that hierarchy removed, every agent is
-    // parentless, so that set *was* every agent anyway; the capability
+    // parentless, so that set *was* every agent anyway; the permission
     // now says so out loud instead of deriving it from a field that no
     // longer discriminates.
     //
     // This is the *only* cross-agent mount left. Dropping the topology
     // parent field took with it the unconditional grant every
     // agent used to get over its own direct children — so an agent with
-    // no capability now sees its own dirs and nothing else.
-    if holds_manage_root_agent(agent_name, &crate::capabilities::path()) {
+    // no permission now sees its own dirs and nothing else.
+    if holds_manage_root_agent(agent_name, &crate::permissions::path()) {
         // Skipping self is a no-op, not a narrowing: `agent_notes_dir` is
         // `agent_state_dir/state` and `config_bind_source` is shared, so
         // binding the holder as its own virtual child reproduced the two
@@ -819,7 +819,7 @@ mod tests {
     fn corrupt_swarm_permissions_deny_without_failing() {
         let dir = tempfile::tempdir().expect("tempdir");
         let path = dir.path().join("swarm-agent-permissions.json");
-        let truncated = "{\n  \"ruth\": {\"capabilities\": [\"manage_root_ag";
+        let truncated = "{\n  \"ruth\": {\"permissions\": [\"manage_root_ag";
         std::fs::write(&path, truncated).expect("seed");
         assert!(!holds_manage_root_agent("ruth", &path));
         assert_eq!(std::fs::read(&path).expect("read"), truncated.as_bytes());
@@ -835,7 +835,7 @@ mod tests {
         assert!(!holds_manage_root_agent("alice", &path));
         std::fs::write(
             &path,
-            r#"{"ruth": {"capabilities": []}, "alice": {"capabilities": ["manage_root_agent"]}}"#,
+            r#"{"ruth": {"permissions": []}, "alice": {"permissions": ["manage_root_agent"]}}"#,
         )
         .expect("seed");
         assert!(!holds_manage_root_agent("ruth", &path));