wire types: add sha + tag to Approval and HelperEvent

approval grows fetched_sha (canonical hive-c0re-vouched sha,
distinct from manager-supplied commit_ref). helperevent
{approvalresolved,spawned,rebuilt} grow optional sha + tag so
the manager can git-show the exact tree it's hearing about
(against the upcoming /agents/<n>/applied.git RO mount) and
know which terminal tag landed. all serde-defaulted; existing
construction sites pass none until the tag-driven flow lands.

hive-c0re/src/approvals.rs

@@ -139,6 +139,7 @@ impl Approvals {
             status: ApprovalStatus::Approved,
             resolved_at: Some(resolved_at),
             note: None,
+            fetched_sha: None,
         })
     }
 
@@ -214,6 +215,7 @@ fn row_to_approval(row: &rusqlite::Row<'_>) -> rusqlite::Result<Approval> {
         status,
         resolved_at: row.get(6)?,
         note: row.get(7)?,
+        fetched_sha: None,
     })
 }