hive-c0re: fast-forward applied/<name>/main too, not just the one-shot relock

argus + mara (PR #4339 review): the previous commit's per-agent lock
relock is a one-shot effect on the single rebuild the cascade triggers
- applied/<name> never moves, so the next relock=true rebuild trigger
(the boot sweep, most notably) re-locks against applied/<name> and
reverts straight back to whatever it was stuck on. The fix didn't
outlive the transaction it ran in.

New forge::fast_forward_applied_main(name), sibling to the existing
reseed-only fetch_config_main_into_applied: for an applied repo that
already has a .git and just needs to catch up, force-set rather than
fast-forward-gated since there's no PR to review on this path either.
Called per cascade agent right after the relock, best-effort so one
unreachable agent repo doesn't block the others.

Once applied/<name>/main has actually moved, lock_update_for_rebuild's
override (always reads current applied/<name>/main, no ?rev pin)
naturally stays in sync on any later relock=true rebuild instead of
reverting.

hive-c0re/src/forge/mod.rs

@@ -18,8 +18,8 @@ pub use pr_merge::{
 pub use reconcile::{reconcile_config_apply, reconcile_config_status};
 pub use repos::{
     clone_config_into_proposed, create_agent_repo, ensure_config_repo, ensure_knowledge_repo,
-    ensure_meta_remote, ensure_repo, ensure_shared_docs_repo, fetch_config_main_into_applied,
-    meta_read_access, push_config, push_meta, shared_docs_access,
+    ensure_meta_remote, ensure_repo, ensure_shared_docs_repo, fast_forward_applied_main,
+    fetch_config_main_into_applied, meta_read_access, push_config, push_meta, shared_docs_access,
 };
 pub use users::{core_token, ensure_user_for, provision_user_token};
 

hive-c0re/src/forge/repos.rs

@@ -593,6 +593,66 @@ pub async fn fetch_config_main_into_applied(name: &str) -> bool {
     true
 }
 
+/// Fast-forward `applied/<name>/main` to the config repo's current live
+/// main. Unlike [`fetch_config_main_into_applied`] (reseed-only — bails
+/// if `applied` already has a `.git`), this is for an `applied` repo that
+/// already exists and just needs to catch up: force-sets the local ref to
+/// match live main rather than requiring a fast-forward or any review
+/// gate — there is no PR to review on this path, so nothing to check
+/// ancestry against. Contrast the approval-deploy flow's CAS'd,
+/// ancestry-gated advance for a reviewed PR merge, which this is not.
+///
+/// Best-effort, same shape as [`fetch_config_main_into_applied`]: returns
+/// `false` (not an error) when the forge is absent, the core token isn't
+/// minted, `applied` has no `.git` yet (nothing to fast-forward — reseed
+/// instead), or any git step fails.
+pub async fn fast_forward_applied_main(name: &str) -> bool {
+    if !is_present().await {
+        return false;
+    }
+    let Some(token) = core_token() else {
+        return false;
+    };
+    let applied = crate::paths::applied_dir(name);
+    if !applied.join(".git").exists() {
+        return false;
+    }
+    let url = forge_git_url(&format!("{CONFIG_ORG}/{name}"));
+    let auth = core_auth_header(&token);
+    let out = crate::lifecycle::git_command_authed(&auth)
+        .current_dir(&applied)
+        .args(["fetch", "--no-tags", &url, "refs/heads/main"])
+        .output()
+        .await;
+    match out {
+        Ok(o) if o.status.success() => {}
+        Ok(o) => {
+            tracing::warn!(
+                %name,
+                stderr = %String::from_utf8_lossy(&o.stderr).trim(),
+                "forge: applied fast-forward fetch failed"
+            );
+            return false;
+        }
+        Err(e) => {
+            tracing::warn!(%name, error = ?e, "forge: applied fast-forward fetch failed");
+            return false;
+        }
+    }
+    if let Err(e) =
+        crate::lifecycle::git_update_ref(&applied, "refs/heads/main", "FETCH_HEAD").await
+    {
+        tracing::warn!(%name, error = ?e, "forge: applied fast-forward update-ref failed");
+        return false;
+    }
+    if let Err(e) = crate::lifecycle::git_read_tree_reset(&applied, "refs/heads/main").await {
+        tracing::warn!(%name, error = ?e, "forge: applied fast-forward read-tree failed");
+        return false;
+    }
+    tracing::info!(%name, "forge: fast-forwarded applied/main to agent-configs main");
+    true
+}
+
 /// Seed an agent's `proposed` repo from `agent-configs/<name>` on the forge.
 ///
 /// When the swarm creates an agent it writes that agent's config to the forge