c0re: address argus review nits on #434

hive-c0re/src/manager_server.rs

@@ -635,8 +635,11 @@ async fn submit_apply_commit(
         .map_err(|e| anyhow::anyhow!("persist fetched_sha: {e:#}"))?;
     // #317 pre-flight gates: both reject the apply before approval if
     // the agent's flake state would inflate meta's lock with duplicates
-    // or lie about what nix will fetch. Order matters — sync first so
-    // the dedup pass acts on the lock nix would actually produce.
+    // or lie about what nix will fetch. Both checks independently read
+    // `<tag>:flake.lock` via git — they don't share state. Order matters
+    // only for early-exit + messaging: sync first means a stale lock
+    // bails with the actionable "run `nix flake lock`" hint rather than
+    // a dedup pass on a lock nix would never produce.
     //
     // Runs after `set_fetched_sha` so the failed row carries the sha
     // that broke. Both failure paths mark + emit, then bail.