fix(#2971): thread the queue node id into nix_logged

`nix_logged` wrote its `build_logs` row with `node_id = None`, so a deploy's
eval/relock log was reachable from the agent+kind+time listing but not from
the queue node that ran it.

The comment justifying the `None` said both callers are "reached from outside
the queue as well as from inside it". That is no longer true: `verify_commit`
and `prepare_deploy` have exactly one caller each, and both sit under the
`MergeVerify` / `DeployApply` arms of `exec.rs`'s node dispatch, where the
`NodeId` is already in scope.

Threads `Option<u64>` from the dispatch down, mirroring `prebuild_toplevel`'s
existing `Some(id.get())` at exec.rs:241. Kept as `Option` rather than a bare
`u64` because `meta::prepare_deploy` / `meta::verify_commit` are public API and
a future non-queue caller has no node to name; the comment now says that
instead of the stale claim.

No behaviour change beyond the log row gaining its node link.

hive-c0re/src/meta.rs

@@ -243,7 +243,7 @@ pub async fn sync_agents(hive: &HiveEnv, agents: &[AgentSpec]) -> Result<()> {
 /// the index. Doesn't commit — `finalize_deploy` commits on build
 /// success, `abort_deploy` drops the staged change on failure so
 /// meta history only carries successful deploys.
-pub async fn prepare_deploy(name: &str) -> Result<()> {
+pub async fn prepare_deploy(name: &str, node_id: Option<u64>) -> Result<()> {
     let _guard = META_LOCK.lock().await;
     let dir = crate::paths::meta_root();
     let input = format!("agent-{name}");
@@ -268,6 +268,7 @@ pub async fn prepare_deploy(name: &str) -> Result<()> {
         ],
         name,
         "prepare-deploy",
+        node_id,
     )
     .await?;
     // Stage the new lock — git+file://'s dirty-tree fetcher reads
@@ -375,7 +376,12 @@ fn applied_override_url(applied_dir: &Path) -> String {
 /// resolution at the same cost profile as the legacy pre-merge check;
 /// the real container build still runs (and can still roll back) on the
 /// actual apply, so this is the right "would this apply" gate.
-pub async fn verify_commit(name: &str, applied_dir: &Path, sha: &str) -> Result<()> {
+pub async fn verify_commit(
+    name: &str,
+    applied_dir: &Path,
+    sha: &str,
+    node_id: Option<u64>,
+) -> Result<()> {
     let _guard = META_LOCK.lock().await;
     let dir = crate::paths::meta_root();
     let input = format!("agent-{name}");
@@ -393,6 +399,7 @@ pub async fn verify_commit(name: &str, applied_dir: &Path, sha: &str) -> Result<
         ],
         name,
         "verify",
+        node_id,
     )
     .await
 }
@@ -1586,16 +1593,22 @@ async fn nix(dir: &Path, args: &[&str]) -> Result<()> {
 /// zero build logs to look at. Best-effort logging: a missing global
 /// handle or a failed `start()` just skips the row — the command still
 /// runs and its exit status is still enforced.
-async fn nix_logged(dir: &Path, args: &[&str], agent: &str, kind: &str) -> Result<()> {
+async fn nix_logged(
+    dir: &Path,
+    args: &[&str],
+    agent: &str,
+    kind: &str,
+    node_id: Option<u64>,
+) -> Result<()> {
     let cmdline = format!("nix {}", nix_argv(args).join(" "));
     let logs = crate::build_logs::global();
     let log_id = logs.as_ref().and_then(|h| {
-        // No node id: `nix_logged`'s two callers are meta-flake operations
-        // reached from outside the queue as well as from inside it, and the
-        // agent+kind+time listing is how they're surfaced today. Linking them
-        // to a node would mean threading the id through `meta`'s public API
-        // for no current reader — worth doing when something wants it.
-        h.start(agent, kind, &cmdline, None)
+        // `node_id` links the row to the queue node that ran it, so the
+        // dashboard can reach this log from the node instead of only from the
+        // agent+kind+time listing. Both call paths are queue-only today and
+        // pass `Some`; it stays an `Option` because these are `meta`'s public
+        // API and a future non-queue caller has no node to name.
+        h.start(agent, kind, &cmdline, node_id)
             .map_err(|e| {
                 tracing::warn!(error = ?e, %kind, "build_logs: start failed (meta log dropped)");
             })