fix(hive-c0re): close review findings on the job-DAG queue

- deploy-window gate (meta::exclusive) + path-limited meta commits:
  a perm/lock/topology commit can no longer sweep an ApprovalDeploy's
  staged flake.lock and neuter abort_deploy (regression test included)
- cancel surfaces now buffer terminal roll-ups the scheduler drains,
  so a queued approval DAG cancelled by the operator resolves its
  approval instead of dangling, and cancelled power ops revert their
  wanted flip to the observed state
- hivectl restart / restart-all ride the queue (lease serialization,
  transient guard) and restart sets wanted=Up like the old kill+start
- exactly one Rebuilt event per rebuild DAG, emitted at terminal
- StopForUpdate pre-seeds a missing agent_power row from the pre-stop
  observation so a rebuild can't strand an unknown agent offline
- history trim keeps terminal fan-out parents with live children
- audit_log back on db::open; swarm.js badge for reconcile DAGs

hive-c0re/src/job_queue/model.rs

@@ -33,8 +33,9 @@ pub enum Template {
     /// non-fatal) node; stale agents' `Rebuild` DAGs fan out on
     /// completion.
     StartupSweep,
-    /// `StopForUpdate → Reconcile` — stop + converge back to `wanted`
-    /// (unchanged), i.e. a restart for a wanted-up agent.
+    /// `StopForUpdate → Reconcile` with `wanted` set to `Up` at submit
+    /// time — a mechanical stop + start, like the old
+    /// `lifecycle::restart`, regardless of prior intent drift.
     Restart,
     /// `WritePermFile → Prebuild → StopForUpdate → Swap → Reconcile` —
     /// perm-file commit followed by the rebuild subgraph.