wire types: add sha + tag to Approval and HelperEvent

approval grows fetched_sha (canonical hive-c0re-vouched sha,
distinct from manager-supplied commit_ref). helperevent
{approvalresolved,spawned,rebuilt} grow optional sha + tag so
the manager can git-show the exact tree it's hearing about
(against the upcoming /agents/<n>/applied.git RO mount) and
know which terminal tag landed. all serde-defaulted; existing
construction sites pass none until the tag-driven flow lands.

hive-c0re/src/server.rs

@@ -83,6 +83,7 @@ async fn dispatch(req: &HostRequest, coord: Arc<Coordinator>) -> HostResponse {
                             agent: name.clone(),
                             ok: true,
                             note: None,
+                            sha: None,
                         });
                     }
                     Err(e) => {
@@ -92,6 +93,7 @@ async fn dispatch(req: &HostRequest, coord: Arc<Coordinator>) -> HostResponse {
                             agent: name.clone(),
                             ok: false,
                             note: Some(format!("{e:#}")),
+                            sha: None,
                         });
                         return Err(e);
                     }