actions: deny plants annotated denied/<id> tag

apply-commit denials now leave a git object behind: tag
denied/<id> annotated with the operator's note (or empty body
if they didn't supply one) at proposal/<id> inside the applied
repo. rejected configs become first-class git history — git
show denied/<id> in the manager's applied.git mount yields the
tree the operator rejected plus the reason. helper event
carries the tag for parity with deployed/failed. spawn denials
fall through unannotated since they have no proposal commit.
deny becomes async (single git plumbing call); dashboard +
admin-socket callers grow .await.

hive-c0re/src/dashboard.rs

@@ -460,7 +460,7 @@ async fn post_deny(
         .as_deref()
         .map(str::trim)
         .filter(|s| !s.is_empty());
-    match actions::deny(&state.coord, id, note) {
+    match actions::deny(&state.coord, id, note).await {
         Ok(()) => Redirect::to("/").into_response(),
         Err(e) => error_response(&format!("deny {id} failed: {e:#}")),
     }