fix(hive-c0re): close review findings on the job-DAG queue

- deploy-window gate (meta::exclusive) + path-limited meta commits:
  a perm/lock/topology commit can no longer sweep an ApprovalDeploy's
  staged flake.lock and neuter abort_deploy (regression test included)
- cancel surfaces now buffer terminal roll-ups the scheduler drains,
  so a queued approval DAG cancelled by the operator resolves its
  approval instead of dangling, and cancelled power ops revert their
  wanted flip to the observed state
- hivectl restart / restart-all ride the queue (lease serialization,
  transient guard) and restart sets wanted=Up like the old kill+start
- exactly one Rebuilt event per rebuild DAG, emitted at terminal
- StopForUpdate pre-seeds a missing agent_power row from the pre-stop
  observation so a rebuild can't strand an unknown agent offline
- history trim keeps terminal fan-out parents with live children
- audit_log back on db::open; swarm.js badge for reconcile DAGs

hive-c0re/src/audit_log.rs

@@ -119,11 +119,8 @@ impl AuditLog {
     /// Returns an error if the directory can't be created, the sqlite
     /// file can't be opened, or applying the schema fails.
     pub fn open(db_dir: &Path) -> Result<Self> {
-        std::fs::create_dir_all(db_dir)
-            .with_context(|| format!("create audit_log db parent {}", db_dir.display()))?;
         let path = db_dir.join("audit_log.sqlite");
-        let conn = Connection::open(&path)
-            .with_context(|| format!("open audit_log db {}", path.display()))?;
+        let conn = crate::db::open(&path, "audit_log")?;
         conn.execute_batch(SCHEMA)
             .context("apply audit_log schema")?;
         Ok(Self {