agent capabilities live in a swarm KV record, set from swarmctl

An agent's capabilities move from the hive's meta repo
(`meta/capabilities.json`, injected as `HIVE_CAPABILITIES`) into the
`capabilities` field of its key in a new `agent-permissions` KV bucket,
which swarm-controller alone writes.

- swarm-queue-client: `agent_permissions` (bucket, key, `AgentPermissions`,
  direct-get read, the import subject and its wire types).
- swarm-controller: creates the bucket at start; `GET|PUT|DELETE
  /api/agents/{name}/permissions` (deny_unknown_fields and unknown
  capability ⇒ 422, duplicate ⇒ 400, agent must be declared by a hive);
  answers each hive's one-shot import, writing a key only where there is
  none and only for agents that hive's wanted state declares.
- swarmctl: `agent permissions get|set|clear`.
- swarm-nats-auth: a hive reads every key of the bucket and sends its
  import on its own subject; the controller subscribes to the imports and
  may answer them (`responses`).
- hive-c0re: reads each of its agents' keys every 30s into
  /var/lib/hyperhive/swarm-agent-permissions.json and restarts an agent,
  gracefully, when its capabilities change. Unset is the compiled-in
  default (ruth: manage_root_agent; everyone else: none). A failed read
  keeps the stored value. On first boot it seeds that file from
  meta/capabilities.json, sends the grants to the controller, and deletes
  the file once the controller answers.

Deleted: the capabilities.json reader/writer, `HIVE_CAPABILITIES` in the
rendered meta flake, ruth's capability seed, the capabilities half of the
permissions rebuild job (`PermPayload::Capabilities`/`Combined`), the
dashboard's capabilities table and `capabilities_changed` event, and the
now-unused `Capability::description`.

Part of #5170.

hive-c0re/src/coordinator.rs

@@ -565,41 +565,6 @@ impl Coordinator {
             .map(|m| m.keys().cloned().collect())
     }
 
-    /// Emit a `CapabilitiesChanged` snapshot event. Called from the
-    /// rebuild-queue worker after a `PermChange` / Capabilities entry
-    /// commits the JSON file, so the P3RM1SS10NS tab updates live.
-    pub fn emit_capabilities_snapshot(self: &Arc<Self>) {
-        use hive_sh4re::permissions::Capability;
-        let caps = Capability::ALL.iter().map(|c| <&str>::from(*c)).collect();
-        let descriptions = Capability::ALL
-            .iter()
-            .map(|c| (<&str>::from(*c), c.description()))
-            .collect();
-        // An empty snapshot would show every agent as having lost its
-        // capabilities; emit nothing and let the HTTP refetch report it.
-        let assignments = match crate::capabilities::read() {
-            Ok(map) => map,
-            Err(e) => {
-                tracing::warn!(error = ?e, "capabilities snapshot skipped");
-                return;
-            }
-        };
-        // Best-effort roster (sync path); on a contended cache miss we
-        // emit explicit keys only — the HTTP refetch fills the rest in.
-        let roster = self.live_container_names_blocking().unwrap_or_default();
-        // Capability default is "no extra caps" — empty default slice.
-        let (agents, effective) =
-            crate::dashboard::permissions::roster_and_effective(roster, &assignments, &[]);
-        self.emit_dashboard_event(DashboardEvent::CapabilitiesChanged {
-            seq: self.next_seq(),
-            caps,
-            descriptions,
-            assignments,
-            agents,
-            effective,
-        });
-    }
-
     /// Emit a `ToolGroupsChanged` snapshot event. Called from the
     /// rebuild-queue worker after a `PermChange` / `ToolGroups` entry
     /// commits the JSON file, so the P3RM1SS10NS tab updates live.