fold hive-c0re module tree into the daemon binary + drop dead pub items surfaced by bin-only (#2513)

hive-c0re/src/stores/approvals.rs

@@ -75,8 +75,7 @@ impl Approvals {
     /// when the sha is already known at submission time (e.g. `MergeConfigPr`
     /// fetches the PR head before inserting), making the insert + sha-set
     /// atomic.  Pass `None` when the kind carries no sha (e.g. `Spawn` /
-    /// `InitConfig`) or the sha is resolved after insertion, then call
-    /// [`set_fetched_sha`] separately.
+    /// `InitConfig`).
     pub fn submit_kind(
         &self,
         agent: &str,
@@ -126,17 +125,6 @@ impl Approvals {
         Ok(submitter)
     }
 
-    /// Record the canonical sha hive-c0re fetched from the proposed repo
-    /// into applied at submission time. Idempotent on identical values.
-    pub fn set_fetched_sha(&self, id: i64, sha: &str) -> Result<()> {
-        let conn = self.conn.lock().unwrap();
-        conn.execute(
-            "UPDATE approvals SET fetched_sha = ?1 WHERE id = ?2",
-            params![sha, id],
-        )?;
-        Ok(())
-    }
-
     /// Return the `(id, fetched_sha)` of the pending `merge_config_pr`
     /// approval for `(agent, pr_number)`, if one exists. Drives
     /// `submit_merge_config_pr`'s idempotency + PR-drift handling: same
@@ -583,7 +571,7 @@ mod tests {
     fn fetched_sha_in_insert_is_readable_via_get() {
         // `submit_kind` with `Some(sha)` must store it atomically in the
         // INSERT — the `get()` row must reflect it without a separate
-        // `set_fetched_sha` call. This is the MergeConfigPr path.
+        // sha-set step. This is the MergeConfigPr path.
         let (_dir, _path, db) = open_temp();
         let sha = "abc1234567890abc1234567890abc1234567890ab";
         let id = db

hive-c0re/src/stores/audit_log.rs

@@ -40,13 +40,6 @@ pub fn install(handle: Arc<AuditLog>) {
     let _ = GLOBAL.set(handle);
 }
 
-/// Fetch the process-wide handle, or `None` if `install` hasn't run yet
-/// (early startup, or unit tests). Callers must gracefully no-op on `None`.
-#[must_use]
-pub fn global() -> Option<Arc<AuditLog>> {
-    GLOBAL.get().cloned()
-}
-
 /// Retain audit rows for 90 days. Longer than build-log retention — this
 /// is a security/accountability record, not debug noise; the operator may
 /// want to review "who restarted what" well after the fact.