wip(#1838): add MergeConfigPr approvalkind + match-site arms

hive-c0re/src/actions.rs

@@ -128,6 +128,28 @@ pub async fn approve(coord: Arc<Coordinator>, id: i64) -> Result<()> {
             }
             result
         }
+        ApprovalKind::MergeConfigPr => {
+            // Like ApplyCommit, the work ends in a container rebuild, so
+            // route it through the rebuild queue. The queue worker
+            // dispatches MergeConfigPr approvals to `run_merge_config_pr`
+            // (verify the reviewed PR head, ff the forge config repo's
+            // main to it, mark merged, then the shared deploy tail).
+            coord
+                .rebuild_queue
+                .enqueue_full(crate::rebuild_queue::FullEnqueue {
+                    kind: crate::rebuild_queue::QueueKind::Rebuild,
+                    agent: approval.agent.clone(),
+                    source: crate::rebuild_queue::QueueSource::Approval,
+                    reason: format!("approval #{id} merge config pr"),
+                    parent_id: None,
+                    inputs: Vec::new(),
+                    approval_id: Some(id),
+                    perm_payload: None,
+                    depends_on: Vec::new(),
+                });
+            coord.emit_rebuild_queue_snapshot();
+            Ok(())
+        }
     }
 }
 
@@ -381,6 +403,7 @@ fn finish_approval(
         ApprovalKind::InitConfig => "init_config",
         ApprovalKind::UpdateMetaInputs => "update_meta_inputs",
         ApprovalKind::SchedulePrompt => "schedule_prompt",
+        ApprovalKind::MergeConfigPr => "merge_config_pr",
     };
     let sha_short = approval
         .fetched_sha
@@ -430,6 +453,15 @@ fn finish_approval(
             sha: approval.fetched_sha.clone(),
             tag: terminal_tag,
         }),
+        // MergeConfigPr ends in a container rebuild like ApplyCommit, so
+        // surface the same Rebuilt lifecycle event.
+        ApprovalKind::MergeConfigPr => coord.notify_manager(&HelperEvent::Rebuilt {
+            agent: approval.agent.clone(),
+            ok,
+            note,
+            sha: approval.fetched_sha.clone(),
+            tag: terminal_tag,
+        }),
         // UpdateMetaInputs / SchedulePrompt: ApprovalResolved already
         // carries the result. No separate lifecycle event needed.
         ApprovalKind::UpdateMetaInputs | ApprovalKind::SchedulePrompt => {}
@@ -809,6 +841,7 @@ pub async fn deny(coord: &Coordinator, id: i64, note: Option<&str>) -> Result<()
             ApprovalKind::InitConfig => "init_config",
             ApprovalKind::UpdateMetaInputs => "update_meta_inputs",
             ApprovalKind::SchedulePrompt => "schedule_prompt",
+            ApprovalKind::MergeConfigPr => "merge_config_pr",
         };
         let sha_short = sha.as_deref().map(|s| s[..s.len().min(12)].to_owned());
         let description = a.description.clone();