meta: non-mutating verify_commit + pre-flight eval before apply

hive-c0re/src/actions.rs

@@ -493,6 +493,37 @@ async fn run_apply_commit(
         }
     };
 
+    // Pre-flight eval-verify the proposal commit against the meta flake
+    // WITHOUT mutating applied/main or the meta lock, so an evaluation
+    // error (bad nix, missing module option, unresolvable lock) fails
+    // fast here instead of after we've fast-forwarded main and have to
+    // roll it back. Skipped on first spawn: the agent has no
+    // `agent-<name>` meta input to override yet (sync_agents adds it
+    // below). This is the reusable verify primitive the PR-based config
+    // flow gates its irreversible ff-push on.
+    if !is_first_spawn {
+        let proposal_sha = match lifecycle::git_rev_parse(applied_dir, &proposal_ref).await {
+            Ok(s) => s,
+            Err(e) => {
+                return (
+                    Err(anyhow::anyhow!("rev-parse {proposal_ref}: {e:#}")),
+                    None,
+                    is_first_spawn,
+                );
+            }
+        };
+        coord.set_queue_step(queue_entry_id, "verify proposal (eval)");
+        if let Err(e) =
+            crate::meta::verify_commit(&approval.agent, applied_dir, &proposal_sha).await
+        {
+            return (
+                Err(anyhow::anyhow!("verify proposal {proposal_ref}: {e:#}")),
+                None,
+                is_first_spawn,
+            );
+        }
+    }
+
     coord.set_queue_step(queue_entry_id, "plant tags");
     if let Err(e) = lifecycle::git_tag(applied_dir, &format!("approved/{id}"), &proposal_ref).await
     {