agent permissions: one set, tool groups included, set at agent creation

mara on #5170: "dont split caps and perms. its all perms. / dont include
the now empty tool groups / nothing set -> default / also add perms to
agent creation screen".

- hive-sh4re: one `Permission` enum (messaging, meta, inbox, execution,
  web_tools, manage_root_agent) replaces `ToolGroup` and `Capability`;
  `lifecycle`/`forge` are gone. `Permission::default_for` is the default
  for an agent the swarm sets nothing for.
- The record is `{ "permissions": [...] }`. Missing key, unset field or
  no successful read yet = default; `[]` = none; a failed read after a
  good one keeps the last value.
- hive-agent reads its own key every 10s and builds each turn's --tools,
  --allowedTools and MCP config (rewritten before every turn) from it;
  the subagent daemon reads it on each start/continue. Agents get a
  read-only grant on their own key.
- hive-c0re restarts an agent only when its manage_root_agent changes.
  The import now merges meta/capabilities.json and meta/tool-groups.json
  into one list per agent and deletes both; the "import pending, don't
  read" decision is `ImportOutcome::read_allowed`, table-tested.
- swarm-controller: `GET /api/permissions` (names + default) and an
  optional `permissions` on `POST /api/agents`, stored before the job is
  queued. swarm-ui's create-agent form gets a permissions field.
- Deleted: HIVE_TOOL_GROUPS and its forward to the subagent daemon,
  tool_groups.rs, ruth's tool-group seed, the permissions rebuild job
  (PermPayload/WritePermFile/perm_change), the dashboard permissions tab
  and its stale-entries panel.

Part of #5170.

nix/agent-modules/mcp.nix

@@ -382,17 +382,7 @@ in
         # HIVE_AGENT_SOCKET (agent-service.nix).
         HIVE_AGENT_SOCKET = "/run/hive-agent/${userName}/agent.sock";
         RUST_LOG = "info";
-        # This daemon resolves each subagent's `--tools` from the same
-        # tool groups the harness resolves its own session from, so that a
-        # subagent's built-in tools are its parent agent's and never wider.
-        # The meta renderer writes this var onto the harness unit alone, so
-        # forward it from there rather than re-deriving it: without it the
-        # daemon falls back to the default groups and an agent granted
-        # `web_tools` would spawn subagents that quietly lack web access.
-        # `null` when the agent has no groups declared, which systemd drops
-        # — the same "absent" the harness itself would see.
-        HIVE_TOOL_GROUPS = config.systemd.services.hive-agent.environment.HIVE_TOOL_GROUPS or null;
-        # The harness's runtime selection, forwarded the same way, so an ACP
+        # The harness's runtime selection, forwarded from its unit, so an ACP
         # agent's subagents run on its ACP agent. All five are absent on a
         # claude agent, which the daemon reads as claude.
         HIVE_RUNTIME = config.systemd.services.hive-agent.environment.HIVE_RUNTIME or null;

nix/host-modules/swarm-nats.nix

@@ -831,6 +831,11 @@ in
                 # Its own key of the `agent-inference` KV bucket
                 # (`swarm_queue_client::agent_inference`), on the same terms.
                 "--agent-token-publish-subject ${lib.escapeShellArg "\$\$JS.API.DIRECT.GET.KV_agent-inference.\$\$KV.agent-inference.{agent}"}"
+                # Its own key of the `agent-permissions` KV bucket
+                # (`swarm_queue_client::agent_permissions`), on the same terms:
+                # the harness and the subagent daemon read the tool permissions
+                # it holds.
+                "--agent-token-publish-subject ${lib.escapeShellArg "\$\$JS.API.DIRECT.GET.KV_agent-permissions.\$\$KV.agent-permissions.{agent}"}"
                 "--store-cert-role ${lib.escapeShellArg authCertRole}"
               ];
               # The store identity arrives by `LoadCredential` and is named

nix/module-eval/nats-authelia.nix

@@ -312,7 +312,7 @@ let
       # The whole per-agent grant, compared as a list rather than by infix: a
       # wider subject added beside these (`$$JS.API.>`, another stream's name)
       # would pass every presence check above.
-      name = "a verified agent's grant is exactly its own subjects, and its JetStream API subjects read its own schedule and inference keys";
+      name = "a verified agent's grant is exactly its own subjects, and its JetStream API subjects read its own schedule, inference and permissions keys";
       ok =
         let
           args = lib.splitString " " (responderOf natsOldPath).serviceConfig.ExecStart;
@@ -332,6 +332,7 @@ let
           "'$$SWARM.term.{agent}.sub.>'"
           "'$$JS.API.DIRECT.GET.KV_agent-schedules.$$KV.agent-schedules.{agent}'"
           "'$$JS.API.DIRECT.GET.KV_agent-inference.$$KV.agent-inference.{agent}'"
+          "'$$JS.API.DIRECT.GET.KV_agent-permissions.$$KV.agent-permissions.{agent}'"
         ];
     }
     {