wire types: add sha + tag to Approval and HelperEvent

approval grows fetched_sha (canonical hive-c0re-vouched sha,
distinct from manager-supplied commit_ref). helperevent
{approvalresolved,spawned,rebuilt} grow optional sha + tag so
the manager can git-show the exact tree it's hearing about
(against the upcoming /agents/<n>/applied.git RO mount) and
know which terminal tag landed. all serde-defaulted; existing
construction sites pass none until the tag-driven flow lands.

hive-c0re/src/auto_update.rs

@@ -78,6 +78,8 @@ pub async fn rebuild_agent(coord: &Arc<Coordinator>, name: &str, current_rev: &s
                 agent: name.to_owned(),
                 ok: true,
                 note: None,
+                sha: None,
+                tag: None,
             });
         }
         Err(e) => {
@@ -85,6 +87,8 @@ pub async fn rebuild_agent(coord: &Arc<Coordinator>, name: &str, current_rev: &s
                 agent: name.to_owned(),
                 ok: false,
                 note: Some(format!("{e:#}")),
+                sha: None,
+                tag: None,
             });
         }
     }