fix(hive-c0re): close review findings on the job-DAG queue

- deploy-window gate (meta::exclusive) + path-limited meta commits:
  a perm/lock/topology commit can no longer sweep an ApprovalDeploy's
  staged flake.lock and neuter abort_deploy (regression test included)
- cancel surfaces now buffer terminal roll-ups the scheduler drains,
  so a queued approval DAG cancelled by the operator resolves its
  approval instead of dangling, and cancelled power ops revert their
  wanted flip to the observed state
- hivectl restart / restart-all ride the queue (lease serialization,
  transient guard) and restart sets wanted=Up like the old kill+start
- exactly one Rebuilt event per rebuild DAG, emitted at terminal
- StopForUpdate pre-seeds a missing agent_power row from the pre-stop
  observation so a rebuild can't strand an unknown agent offline
- history trim keeps terminal fan-out parents with live children
- audit_log back on db::open; swarm.js badge for reconcile DAGs

frontend/packages/dashboard/src/swarm.js

@@ -811,6 +811,7 @@ export function renderContainers(s) {
                 : op.kind === 'start'       ? 'starting'
                 : op.kind === 'stop'        ? 'stopping'
                 : op.kind === 'graceful_stop' ? 'stopping'
+                : op.kind === 'reconcile'   ? 'reconciling'
                 : 'rebuilding')
             : (op.kind === 'meta_update'    ? 'meta-update queued'
                 : op.kind === 'destroy'     ? 'destroy queued'
@@ -818,6 +819,7 @@ export function renderContainers(s) {
                 : op.kind === 'start'       ? 'start queued'
                 : op.kind === 'stop'        ? 'stop queued'
                 : op.kind === 'graceful_stop' ? 'stop queued'
+                : op.kind === 'reconcile'   ? 'reconcile queued'
                 : 'rebuild queued')));
     const opRunning = transientKind != null
       || (op != null && op.state === 'running');