refactor(#2416): drop the now-always-none Spawned.sha field + deny tag leftover

docs/approvals.md

@@ -576,15 +576,12 @@ root agent. Variants (`hive_sh4re::HelperEvent`):
   The recipient responds via `Answer { id, answer }` and the
   asker sees the matching `QuestionAnswered`.
 
-Optional `sha` field on `ApprovalResolved`, `Spawned`, and `Rebuilt`
-carries the canonical hive-c0re-vouched commit sha. Optional `tag`
-on `ApprovalResolved` and `Rebuilt` only — the spawn path always
-lands at `deployed/0`, so the tag is implicit and not echoed. The
-tag values for the variants that do carry it: `deployed/<id>` /
-`failed/<id>` / `denied/<id>` for approval-driven flows;
-`approved/<id>` for the rare bare-approval case where no underlying
-action runs. Both fields are `Option`: `None` on the rebuild paths
-that don't change the deployed commit (e.g.
+Optional `sha` field on `ApprovalResolved` and `Rebuilt` carries the
+canonical hive-c0re-vouched commit sha. Optional `tag` on the same two
+carries the deploy bookkeeping tag — `deployed/<id>` on a successful
+build or `failed/<id>` on a failed one, planted by the `MergeConfigPr`
+deploy. Both fields are `Option`: `None` on the paths that don't deploy
+a new commit (spawn / init_config / meta-update / deny, and
 `auto_update::rebuild_agent` reapplying the existing main, or the
 dashboard `↻ R3BU1LD` button when the lock didn't move). When set,
 `git show <sha>` against `/agents/<n>/applied.git` inside the

hive-c0re/src/actions.rs

@@ -618,7 +618,6 @@ fn finish_approval(
                 agent: approval.agent.clone(),
                 ok,
                 note,
-                sha: approval.fetched_sha.clone(),
             },
         ),
         // MergeConfigPr ends in a container rebuild — surface a Rebuilt
@@ -863,8 +862,6 @@ pub fn deny(coord: &Coordinator, id: i64, note: Option<&str>) -> Result<()> {
     let approval = coord.approvals.get(id)?;
     coord.approvals.mark_denied(id, note)?;
     tracing::info!(%id, note, "approval denied");
-    // MergeConfigPr denials carry no git tag — the PR stays open on the forge.
-    let tag: Option<String> = None;
     if let Some(a) = approval {
         let sha = a.fetched_sha.clone();
         let approval_kind = a.kind.as_str();
@@ -880,7 +877,8 @@ pub fn deny(coord: &Coordinator, id: i64, note: Option<&str>) -> Result<()> {
                 status: ApprovalStatus::Denied,
                 note: note.map(String::from),
                 sha,
-                tag,
+                // A denied config PR carries no git tag — it stays open on the forge.
+                tag: None,
             },
         );
         coord.emit_approval_resolved(crate::coordinator::ApprovalResolved {

hive-c0re/src/server.rs

@@ -247,7 +247,6 @@ async fn handle_spawn(coord: &Arc<Coordinator>, name: &str) -> Result<HostRespon
                 agent: name.to_owned(),
                 ok: true,
                 note: None,
-                sha: None,
             });
             // Update tmpfiles.d so the new agent's dirs survive a reboot.
             tokio::spawn(lifecycle::sync_tmpfiles());
@@ -259,7 +258,6 @@ async fn handle_spawn(coord: &Arc<Coordinator>, name: &str) -> Result<HostRespon
                 agent: name.to_owned(),
                 ok: false,
                 note: Some(format!("{e:#}")),
-                sha: None,
             });
             return Err(e);
         }

hive-sh4re/src/lib.rs

@@ -817,8 +817,6 @@ pub enum HelperEvent {
         ok: bool,
         #[serde(default, skip_serializing_if = "Option::is_none")]
         note: Option<String>,
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        sha: Option<String>,
     },
     /// A container was rebuilt (auto-update or manual).
     Rebuilt {