fix #289: full forge sync on rebuild (extract sync_agent, use in rebuild_agent)

extract per-agent forge logic from ensure_all() into sync_agent()
so both the startup sweep and rebuild_agent call identical code.
rebuild now runs: ensure_user_for + ensure_config_repo + push_config
+ meta_read_access + ensure_meta_remote — same as the boot sweep.
missing tokens and drift in any forge state are fixed by rebuild,
not just hive reboot.

hive-c0re/src/auto_update.rs

@@ -101,13 +101,13 @@ pub async fn rebuild_agent(coord: &Arc<Coordinator>, name: &str, current_rev: &s
                 sha: None,
                 tag: None,
             });
-            // Re-seed the forge token on every rebuild so a missing
-            // token (e.g. first-spawn seeding failed transiently) is
-            // fixed by the next rebuild rather than requiring a full
-            // hive-c0re restart.
-            if let Err(e) = crate::forge::ensure_user_for(name).await {
-                tracing::warn!(%name, error = ?e, "forge: ensure_user after rebuild failed");
-            }
+            // Run the full forge sync on every successful rebuild so
+            // the rebuild path is equivalent to the hive-c0re startup
+            // sweep: token, config-repo mirror, meta read access, and
+            // meta remote are all kept in sync. Recovers missing tokens
+            // (e.g. first-spawn seeding failed transiently) without
+            // requiring a full hive-c0re restart.
+            crate::forge::sync_agent(name, crate::forge::core_token().as_deref()).await;
             // Wake the agent on its next turn so claude sees a
             // "you were rebuilt — check /state/ for notes, --continue
             // session intact" hint. Covers dashboard rebuild, admin