wire types: add sha + tag to Approval and HelperEvent

approval grows fetched_sha (canonical hive-c0re-vouched sha,
distinct from manager-supplied commit_ref). helperevent
{approvalresolved,spawned,rebuilt} grow optional sha + tag so
the manager can git-show the exact tree it's hearing about
(against the upcoming /agents/<n>/applied.git RO mount) and
know which terminal tag landed. all serde-defaulted; existing
construction sites pass none until the tag-driven flow lands.

hive-c0re/src/actions.rs

@@ -105,6 +105,8 @@ fn finish_approval(
         commit_ref: approval.commit_ref.clone(),
         status,
         note: note.clone(),
+        sha: approval.fetched_sha.clone(),
+        tag: None,
     });
     // For spawn/rebuild approvals, also surface the underlying action so
     // the manager knows whether the container actually came up. The
@@ -116,11 +118,14 @@ fn finish_approval(
             agent: approval.agent.clone(),
             ok,
             note,
+            sha: approval.fetched_sha.clone(),
         }),
         ApprovalKind::ApplyCommit => coord.notify_manager(&HelperEvent::Rebuilt {
             agent: approval.agent.clone(),
             ok,
             note,
+            sha: approval.fetched_sha.clone(),
+            tag: None,
         }),
     }
     result
@@ -183,12 +188,15 @@ pub fn deny(coord: &Coordinator, id: i64, note: Option<&str>) -> Result<()> {
     coord.approvals.mark_denied(id, note)?;
     tracing::info!(%id, note, "approval denied");
     if let Some(a) = approval {
+        let sha = a.fetched_sha.clone();
         coord.notify_manager(&HelperEvent::ApprovalResolved {
             id: a.id,
             agent: a.agent,
             commit_ref: a.commit_ref,
             status: ApprovalStatus::Denied,
             note: note.map(String::from),
+            sha,
+            tag: None,
         });
     }
     Ok(())

hive-c0re/src/approvals.rs

@@ -139,6 +139,7 @@ impl Approvals {
             status: ApprovalStatus::Approved,
             resolved_at: Some(resolved_at),
             note: None,
+            fetched_sha: None,
         })
     }
 
@@ -214,6 +215,7 @@ fn row_to_approval(row: &rusqlite::Row<'_>) -> rusqlite::Result<Approval> {
         status,
         resolved_at: row.get(6)?,
         note: row.get(7)?,
+        fetched_sha: None,
     })
 }
 

hive-c0re/src/auto_update.rs

@@ -78,6 +78,8 @@ pub async fn rebuild_agent(coord: &Arc<Coordinator>, name: &str, current_rev: &s
                 agent: name.to_owned(),
                 ok: true,
                 note: None,
+                sha: None,
+                tag: None,
             });
         }
         Err(e) => {
@@ -85,6 +87,8 @@ pub async fn rebuild_agent(coord: &Arc<Coordinator>, name: &str, current_rev: &s
                 agent: name.to_owned(),
                 ok: false,
                 note: Some(format!("{e:#}")),
+                sha: None,
+                tag: None,
             });
         }
     }

hive-c0re/src/server.rs

@@ -83,6 +83,7 @@ async fn dispatch(req: &HostRequest, coord: Arc<Coordinator>) -> HostResponse {
                             agent: name.clone(),
                             ok: true,
                             note: None,
+                            sha: None,
                         });
                     }
                     Err(e) => {
@@ -92,6 +93,7 @@ async fn dispatch(req: &HostRequest, coord: Arc<Coordinator>) -> HostResponse {
                             agent: name.clone(),
                             ok: false,
                             note: Some(format!("{e:#}")),
+                            sha: None,
                         });
                         return Err(e);
                     }