feat(#2471): post failing config deploy build log to the config pr

hive-c0re/src/actions.rs

@@ -198,6 +198,9 @@ pub async fn run_approval_merge_config_pr(
     let approval = fetch_approval_for_worker(coord, approval_id, ApprovalKind::MergeConfigPr)?;
     let agent_dir = crate::paths::agent_runtime_dir(&approval.agent);
     let applied_dir = crate::paths::applied_dir(&approval.agent);
+    // Captured up front to scope the failure-comment's build-log lookup to
+    // rows this deploy produced (see `post_merge_failure_to_pr`).
+    let since_ts = hive_sh4re::wire_time::now_unix();
     coord.set_queue_step(queue_entry_id, "merge config pr");
     let (result, terminal_tag) =
         run_merge_config_pr(coord, &approval, &agent_dir, &applied_dir, queue_entry_id).await;
@@ -210,9 +213,84 @@ pub async fn run_approval_merge_config_pr(
     if let Err(e) = crate::forge::push_config(&approval.agent).await {
         tracing::warn!(agent = %approval.agent, error = ?e, "forge: push_config after merge failed");
     }
+    // On a failed deploy, surface the failing build log back onto the PR so
+    // the manager sees why it was rejected without leaving the forge.
+    if let Err(e) = &result {
+        post_merge_failure_to_pr(coord, &approval, since_ts, e).await;
+    }
     finish_approval(coord, &approval, result, terminal_tag, false)
 }
 
+/// Max stderr bytes to inline in a PR failure comment. Keeps the comment
+/// readable and under forge's size limits while still carrying the tail
+/// where the nix/build error actually surfaces.
+const PR_FAIL_LOG_TAIL_BYTES: usize = 4000;
+
+/// On a failed `MergeConfigPr` deploy, post the failing build log back to the
+/// config PR as a comment so the manager sees the rejection reason on the PR
+/// itself. Best-effort: any error here is logged, never allowed to disturb the
+/// approval-resolution path.
+///
+/// The failing `build_log` row is located heuristically: the most recent `fail`
+/// row for this agent that started at/after `since_ts` (the caller's function
+/// entry). Because deploys are serialised per agent through the queue, that is
+/// the step which just failed — `verify`, `prepare-deploy`, `prebuild`, or the
+/// container rebuild. Pre-build failures (drift gate, fetch) create no `build_log`
+/// row, so the comment then carries only the error text.
+async fn post_merge_failure_to_pr(
+    coord: &Arc<Coordinator>,
+    approval: &hive_sh4re::Approval,
+    since_ts: i64,
+    err: &anyhow::Error,
+) {
+    let Ok(pr) = approval.commit_ref.parse::<u64>() else {
+        return;
+    };
+    let repo = crate::forge::config_repo(&approval.agent);
+
+    let log_section = coord
+        .build_logs
+        .list_recent_for_agent(&approval.agent, 10)
+        .ok()
+        .and_then(|rows| {
+            rows.into_iter()
+                .find(|r| r.status.as_deref() == Some("fail") && r.started_at >= since_ts)
+        })
+        .and_then(|row| coord.build_logs.get_full(row.id).ok().flatten())
+        .map(|full| {
+            let tail = tail_bytes(full.stderr.trim_end(), PR_FAIL_LOG_TAIL_BYTES);
+            format!(
+                "\n\n**Failing step:** `{}` (build log #{})\n\n```\n{tail}\n```",
+                full.header.kind, full.header.id
+            )
+        })
+        .unwrap_or_default();
+
+    let body = format!(
+        "## ⚠️ config deploy failed\n\n\
+         Approval #{} to merge this PR could not be deployed:\n\n\
+         ```\n{err:#}\n```{log_section}",
+        approval.id
+    );
+
+    if let Err(e) = crate::forge::post_pr_comment(&repo, pr, &body).await {
+        tracing::warn!(agent = %approval.agent, %pr, error = ?e, "post merge-failure comment to PR failed");
+    }
+}
+
+/// Return the last `max_bytes` of `s`, snapped to a char boundary, prefixed
+/// with an elision marker when truncated.
+fn tail_bytes(s: &str, max_bytes: usize) -> String {
+    if s.len() <= max_bytes {
+        return s.to_owned();
+    }
+    let mut start = s.len() - max_bytes;
+    while start < s.len() && !s.is_char_boundary(start) {
+        start += 1;
+    }
+    format!("[… truncated …]\n{}", &s[start..])
+}
+
 /// PR-merge config pipeline. `approval.commit_ref` is the PR number;
 /// `approval.fetched_sha` is the PR head sha the operator reviewed. Steps:
 /// 1. drift gate — re-read the live PR head; if it moved since review, abort