fix(hive-c0re): close review findings on the job-DAG queue

- deploy-window gate (meta::exclusive) + path-limited meta commits:
  a perm/lock/topology commit can no longer sweep an ApprovalDeploy's
  staged flake.lock and neuter abort_deploy (regression test included)
- cancel surfaces now buffer terminal roll-ups the scheduler drains,
  so a queued approval DAG cancelled by the operator resolves its
  approval instead of dangling, and cancelled power ops revert their
  wanted flip to the observed state
- hivectl restart / restart-all ride the queue (lease serialization,
  transient guard) and restart sets wanted=Up like the old kill+start
- exactly one Rebuilt event per rebuild DAG, emitted at terminal
- StopForUpdate pre-seeds a missing agent_power row from the pre-stop
  observation so a rebuild can't strand an unknown agent offline
- history trim keeps terminal fan-out parents with live children
- audit_log back on db::open; swarm.js badge for reconcile DAGs

hive-c0re/src/job_queue/submit.rs

@@ -34,8 +34,12 @@ pub fn rebuild(coord: &Arc<Coordinator>, agent: &str, source: Source, reason: St
     submit_and_emit(coord, templates::rebuild(agent, source, reason, None, true))
 }
 
-/// Restart: mechanical stop + converge back to `wanted` (unchanged).
+/// Restart: mechanical stop + converge to `wanted = Up`. The intent
+/// write matters when `wanted` drifted `Offline` under a running
+/// agent — the old `kill + start` always ended up, and an operator
+/// asking for a restart plainly wants it running, not a stop.
 pub fn restart(coord: &Arc<Coordinator>, agent: &str, source: Source, reason: String) -> u64 {
+    set_wanted(coord, agent, Wanted::Up);
     submit_and_emit(coord, templates::restart(agent, source, reason))
 }