phase 8 step 2: approval-gated spawn + dashboard spinner

CLAUDE.md

@@ -232,8 +232,13 @@ See PLAN.md → "Phase 8" for the full design. Summary:
   `/var/lib/hyperhive/agents/<name>/` unless the operator passes an explicit
   wipe flag. Recreating an agent of the same name reuses prior creds.
 - **First spawn is approval-gated.** New agent names go through the same
-  approval queue as config edits. Dashboard shows a spinner during
-  `nixos-container create` + `update` + `start`.
+  approval queue as config edits. Manager calls `RequestSpawn` (CLI:
+  `hive-m1nd request-spawn <name>`); operator can also queue from the
+  dashboard or `hive-c0re request-spawn <name>`. The host's direct
+  `hive-c0re spawn <name>` still works as a privileged bypass for tests.
+  Approve runs `lifecycle::spawn` in a background task; the dashboard polls
+  via `<meta refresh>` and renders a spinner row while
+  `nixos-container create` + `update` + `start` is in flight.
 - **"needs login" partial-run state.** No valid session in `~/.claude/` →
   harness binds the web UI but does NOT start the turn loop. Dashboard
   surfaces this state per-agent.