agent capabilities live in a swarm KV record, set from swarmctl

An agent's capabilities move from the hive's meta repo
(`meta/capabilities.json`, injected as `HIVE_CAPABILITIES`) into the
`capabilities` field of its key in a new `agent-permissions` KV bucket,
which swarm-controller alone writes.

- swarm-queue-client: `agent_permissions` (bucket, key, `AgentPermissions`,
  direct-get read, the import subject and its wire types).
- swarm-controller: creates the bucket at start; `GET|PUT|DELETE
  /api/agents/{name}/permissions` (deny_unknown_fields and unknown
  capability ⇒ 422, duplicate ⇒ 400, agent must be declared by a hive);
  answers each hive's one-shot import, writing a key only where there is
  none and only for agents that hive's wanted state declares.
- swarmctl: `agent permissions get|set|clear`.
- swarm-nats-auth: a hive reads every key of the bucket and sends its
  import on its own subject; the controller subscribes to the imports and
  may answer them (`responses`).
- hive-c0re: reads each of its agents' keys every 30s into
  /var/lib/hyperhive/swarm-agent-permissions.json and restarts an agent,
  gracefully, when its capabilities change. Unset is the compiled-in
  default (ruth: manage_root_agent; everyone else: none). A failed read
  keeps the stored value. On first boot it seeds that file from
  meta/capabilities.json, sends the grants to the controller, and deletes
  the file once the controller answers.

Deleted: the capabilities.json reader/writer, `HIVE_CAPABILITIES` in the
rendered meta flake, ruth's capability seed, the capabilities half of the
permissions rebuild job (`PermPayload::Capabilities`/`Combined`), the
dashboard's capabilities table and `capabilities_changed` event, and the
now-unused `Capability::description`.

Part of #5170.

hive-c0re/src/lifecycle/host_config.rs

@@ -381,22 +381,20 @@ fn bind_own_agent_dirs(agent_name: &str, notes_dir: &Path, binds: &mut Vec<BindM
     }
 }
 
-/// Whether `agent_name` holds `ManageRootAgent` per the capabilities file
-/// at `caps_path`. An unreadable file denies: the error is logged and the
+/// Whether `agent_name` holds `ManageRootAgent` per the swarm permissions
+/// stored at `path`. An unreadable file denies: the error is logged and the
 /// agent starts without the cross-agent mounts, so one corrupt file never
 /// blocks any agent's start, spawn or swap.
-fn holds_manage_root_agent(agent_name: &str, caps_path: &Path) -> bool {
-    crate::capabilities::has_cap(caps_path, agent_name, Capability::ManageRootAgent).unwrap_or_else(
-        |e| {
-            tracing::error!(
-                agent = %agent_name,
-                path = %caps_path.display(),
-                error = ?e,
-                "capabilities unreadable — no ManageRootAgent mounts"
-            );
-            false
-        },
-    )
+fn holds_manage_root_agent(agent_name: &str, path: &Path) -> bool {
+    crate::capabilities::holds(path, agent_name, Capability::ManageRootAgent).unwrap_or_else(|e| {
+        tracing::error!(
+            agent = %agent_name,
+            path = %path.display(),
+            error = ?e,
+            "swarm permissions unreadable — no ManageRootAgent mounts"
+        );
+        false
+    })
 }
 
 /// Env var naming the host directory `swarm-bao-queue-agent.service` lands
@@ -587,7 +585,7 @@ async fn set_nspawn_flags(
     // parent field took with it the unconditional grant every
     // agent used to get over its own direct children — so an agent with
     // no capability now sees its own dirs and nothing else.
-    if holds_manage_root_agent(agent_name, &crate::capabilities::capabilities_path()) {
+    if holds_manage_root_agent(agent_name, &crate::capabilities::path()) {
         // Skipping self is a no-op, not a narrowing: `agent_notes_dir` is
         // `agent_state_dir/state` and `config_bind_source` is shared, so
         // binding the holder as its own virtual child reproduced the two
@@ -818,22 +816,30 @@ mod tests {
     }
 
     #[test]
-    fn a_corrupt_capabilities_file_denies_without_failing() {
+    fn corrupt_swarm_permissions_deny_without_failing() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join("capabilities.json");
-        let truncated = "{\n  \"ruth\": [\"manage_root_ag";
+        let path = dir.path().join("swarm-agent-permissions.json");
+        let truncated = "{\n  \"ruth\": {\"capabilities\": [\"manage_root_ag";
         std::fs::write(&path, truncated).expect("seed");
         assert!(!holds_manage_root_agent("ruth", &path));
         assert_eq!(std::fs::read(&path).expect("read"), truncated.as_bytes());
     }
 
+    /// Unset is the default, which gives ruth the recovery mounts and nobody
+    /// else; a grant or an explicit empty list replaces it.
     #[test]
-    fn a_readable_grant_is_honoured() {
+    fn the_swarm_grant_or_the_default_decides_the_recovery_mounts() {
         let dir = tempfile::tempdir().expect("tempdir");
-        let path = dir.path().join("capabilities.json");
-        std::fs::write(&path, r#"{"ruth": ["manage_root_agent"]}"#).expect("seed");
+        let path = dir.path().join("swarm-agent-permissions.json");
         assert!(holds_manage_root_agent("ruth", &path));
         assert!(!holds_manage_root_agent("alice", &path));
+        std::fs::write(
+            &path,
+            r#"{"ruth": {"capabilities": []}, "alice": {"capabilities": ["manage_root_agent"]}}"#,
+        )
+        .expect("seed");
+        assert!(!holds_manage_root_agent("ruth", &path));
+        assert!(holds_manage_root_agent("alice", &path));
     }
 
     const TRUNCATED_LIMITS: &str = "{\n  \"sock\": { \"cpu_quota\": \"50%\", \"mem";