kick_agent on every rebuild + apply path

agents weren't being woken with the 'you were rebuilt — check
/state/ for notes, --continue intact' system message after
several recent rebuild surfaces:

- auto_update::rebuild_agent — used by the dashboard rebuild
  button, admin-CLI rebuild via lifecycle_action, the startup
  rev-scan, AND the new meta-input update batch loop. kick
  moves *into* rebuild_agent's success arm so all four
  paths benefit. (the dashboard's lifecycle_action extra
  closure was already firing kick — now it's a no-op for the
  rebuild path since rebuild_agent does it.)
- actions::run_apply_commit — apply-commit approve flow built
  + tagged deployed/<id> but never kicked. add kick on
  success with the more specific 'config update applied' hint.
- server.rs::HostRequest::Rebuild — the admin-CLI direct path
  calls lifecycle::rebuild bypassing rebuild_agent. add kick
  on success.

dashboard's restart / start lifecycle_action extras still
kick via their own closures since they don't route through
rebuild_agent. stop / kill / destroy intentionally don't
kick — there's nothing to wake.

hive-c0re/src/actions.rs

@@ -239,9 +239,12 @@ async fn run_apply_commit(
                 // operator can git-commit by hand if they care.
                 tracing::warn!(agent = %approval.agent, %id, error = ?e, "meta finalize_deploy failed");
             }
-            // Don't ignore the coord pointer — keeps the borrow alive
-            // for future tracing additions without re-plumbing.
-            let _ = coord;
+            // Wake the agent on its next turn so claude sees the
+            // config change took effect. Same hint pattern as
+            // auto_update::rebuild_agent — manager approved a
+            // proposal, agent picks up where it left off with the
+            // new env / packages.
+            coord.kick_agent(&approval.agent, "config update applied");
             (Ok(()), Some(tag))
         }
         Err(e) => {