wire types: add sha + tag to Approval and HelperEvent

approval grows fetched_sha (canonical hive-c0re-vouched sha,
distinct from manager-supplied commit_ref). helperevent
{approvalresolved,spawned,rebuilt} grow optional sha + tag so
the manager can git-show the exact tree it's hearing about
(against the upcoming /agents/<n>/applied.git RO mount) and
know which terminal tag landed. all serde-defaulted; existing
construction sites pass none until the tag-driven flow lands.

hive-c0re/src/actions.rs

@@ -105,6 +105,8 @@ fn finish_approval(
         commit_ref: approval.commit_ref.clone(),
         status,
         note: note.clone(),
+        sha: approval.fetched_sha.clone(),
+        tag: None,
     });
     // For spawn/rebuild approvals, also surface the underlying action so
     // the manager knows whether the container actually came up. The
@@ -116,11 +118,14 @@ fn finish_approval(
             agent: approval.agent.clone(),
             ok,
             note,
+            sha: approval.fetched_sha.clone(),
         }),
         ApprovalKind::ApplyCommit => coord.notify_manager(&HelperEvent::Rebuilt {
             agent: approval.agent.clone(),
             ok,
             note,
+            sha: approval.fetched_sha.clone(),
+            tag: None,
         }),
     }
     result
@@ -183,12 +188,15 @@ pub fn deny(coord: &Coordinator, id: i64, note: Option<&str>) -> Result<()> {
     coord.approvals.mark_denied(id, note)?;
     tracing::info!(%id, note, "approval denied");
     if let Some(a) = approval {
+        let sha = a.fetched_sha.clone();
         coord.notify_manager(&HelperEvent::ApprovalResolved {
             id: a.id,
             agent: a.agent,
             commit_ref: a.commit_ref,
             status: ApprovalStatus::Denied,
             note: note.map(String::from),
+            sha,
+            tag: None,
         });
     }
     Ok(())