fix(#1989): don't relock on meta-update cascade rebuilds (was reverting the bump)

hive-c0re/src/rebuild_queue.rs

@@ -886,8 +886,19 @@ async fn dispatch(
         (QueueKind::Rebuild, None) => {
             let current_rev =
                 crate::auto_update::current_flake_rev(&coord.hyperhive_flake).unwrap_or_default();
-            crate::auto_update::rebuild_agent(coord, &entry.agent, &current_rev, Some(entry.id))
-                .await
+            // A meta-update cascade has just set the meta lock; re-locking
+            // in the per-agent rebuild would revert it (the agent's own
+            // flake.lock wins). Every other source wants the relock so it
+            // advances to applied/<n>/main.
+            let relock = entry.source != QueueSource::MetaUpdate;
+            crate::auto_update::rebuild_agent(
+                coord,
+                &entry.agent,
+                &current_rev,
+                Some(entry.id),
+                relock,
+            )
+            .await
         }
         (QueueKind::MetaUpdate, Some(approval_id)) => {
             crate::actions::run_approval_update_meta_inputs(coord, Some(entry.id), approval_id)
@@ -987,7 +998,7 @@ async fn dispatch(
             // env var takes effect in the container.
             let current_rev =
                 crate::auto_update::current_flake_rev(&coord.hyperhive_flake).unwrap_or_default();
-            crate::auto_update::rebuild_agent(coord, name, &current_rev, Some(entry.id)).await
+            crate::auto_update::rebuild_agent(coord, name, &current_rev, Some(entry.id), true).await
         }
         (QueueKind::GracefulStop, _) => run_graceful_stop(coord, entry).await,
         (QueueKind::Start, _) => run_start(coord, entry).await,