manager: needs_login / logged_in / needs_update events + update tool

crash_watch grows two more state-axes alongside running/stopped:

- logged-in (claude session dir populated for the agent)
- up-to-date (recorded flake rev matches current)

per-tick transitions emit HelperEvent::NeedsLogin / LoggedIn /
NeedsUpdate. seed-on-first-tick semantics retained — nothing fires
on harness boot for agents that were already in their state. only
needs_update fires the 'stale appeared' direction; the resolved
direction is already covered by Rebuilt.

new mcp__hyperhive__update(name) on the manager surface: idempotent
rebuild via auto_update::rebuild_agent. transient-aware (Rebuilding)
so the dashboard shows the spinner. login intentionally has NO tool
— it's interactive OAuth, only the operator can complete it.

prompts + approvals doc + turn-loop doc updated. todo grows a
'show per-agent applied config in dashboard' entry (separate
follow-up).

docs/approvals.md

@@ -129,6 +129,14 @@ regular claude turn so the manager can react. Variants
   running container went away with no operator-initiated transient
   state (Stopping / Restarting / Destroying / Rebuilding). Manager
   can `start` it again or escalate.
+- `NeedsLogin { agent }` — sub-agent has no claude session yet.
+  Manager can't act directly (interactive OAuth); typically flags
+  the operator.
+- `LoggedIn { agent }` — sub-agent just completed login. Manager
+  often greets the agent on this event.
+- `NeedsUpdate { agent }` — sub-agent's recorded flake rev is
+  stale. Manager calls `update(name)` to rebuild — idempotent,
+  no approval required.
 - `OperatorAnswered { id, question, answer }` — dashboard
   `/answer-question/{id}` after the operator submits the answer
   form.