kick_agent on every rebuild + apply path

agents weren't being woken with the 'you were rebuilt — check
/state/ for notes, --continue intact' system message after
several recent rebuild surfaces:

- auto_update::rebuild_agent — used by the dashboard rebuild
  button, admin-CLI rebuild via lifecycle_action, the startup
  rev-scan, AND the new meta-input update batch loop. kick
  moves *into* rebuild_agent's success arm so all four
  paths benefit. (the dashboard's lifecycle_action extra
  closure was already firing kick — now it's a no-op for the
  rebuild path since rebuild_agent does it.)
- actions::run_apply_commit — apply-commit approve flow built
  + tagged deployed/<id> but never kicked. add kick on
  success with the more specific 'config update applied' hint.
- server.rs::HostRequest::Rebuild — the admin-CLI direct path
  calls lifecycle::rebuild bypassing rebuild_agent. add kick
  on success.

dashboard's restart / start lifecycle_action extras still
kick via their own closures since they don't route through
rebuild_agent. stop / kill / destroy intentionally don't
kick — there's nothing to wake.

hive-c0re/src/auto_update.rs

@@ -88,6 +88,13 @@ pub async fn rebuild_agent(coord: &Arc<Coordinator>, name: &str, current_rev: &s
                 sha: None,
                 tag: None,
             });
+            // Wake the agent on its next turn so claude sees a
+            // "you were rebuilt — check /state/ for notes, --continue
+            // session intact" hint. Covers dashboard rebuild, admin
+            // CLI rebuild, auto-update startup scan, and the
+            // dashboard's meta-input update path — all of which
+            // route through rebuild_agent.
+            coord.kick_agent(name, "container rebuilt");
         }
         Err(e) => {
             coord.notify_manager(&hive_sh4re::HelperEvent::Rebuilt {