phase 8 step 2: approval-gated spawn + dashboard spinner

hive-c0re/src/main.rs

@@ -44,11 +44,17 @@ enum Cmd {
         #[arg(long, default_value_t = 7000)]
         dashboard_port: u16,
     },
-    /// Spawn a new agent container (`hive-agent-<name>`).
+    /// Spawn a new agent container directly (`hive-agent-<name>`). Bypasses
+    /// the approval queue — use only as an operator on the host. For
+    /// approval-gated spawns, use `request-spawn` instead.
     Spawn { name: String },
+    /// Queue a spawn request as an approval. The container is created on
+    /// `approve <id>` (CLI) or the dashboard's APPR0VE button.
+    RequestSpawn { name: String },
     /// Stop a managed container (graceful).
     Kill { name: String },
-    /// Fully tear down a sub-agent (state + applied repo + drop-in wiped).
+    /// Tear down a sub-agent container. Container is removed; persistent
+    /// state (config repos + Claude credentials) is kept by default.
     Destroy { name: String },
     /// Apply pending config to a managed container.
     Rebuild { name: String },
@@ -91,6 +97,9 @@ async fn main() -> Result<()> {
         Cmd::Spawn { name } => {
             render(client::request(&cli.socket, HostRequest::Spawn { name }).await?)
         }
+        Cmd::RequestSpawn { name } => {
+            render(client::request(&cli.socket, HostRequest::RequestSpawn { name }).await?)
+        }
         Cmd::Kill { name } => {
             render(client::request(&cli.socket, HostRequest::Kill { name }).await?)
         }