kick_agent on every rebuild + apply path

agents weren't being woken with the 'you were rebuilt — check
/state/ for notes, --continue intact' system message after
several recent rebuild surfaces:

- auto_update::rebuild_agent — used by the dashboard rebuild
  button, admin-CLI rebuild via lifecycle_action, the startup
  rev-scan, AND the new meta-input update batch loop. kick
  moves *into* rebuild_agent's success arm so all four
  paths benefit. (the dashboard's lifecycle_action extra
  closure was already firing kick — now it's a no-op for the
  rebuild path since rebuild_agent does it.)
- actions::run_apply_commit — apply-commit approve flow built
  + tagged deployed/<id> but never kicked. add kick on
  success with the more specific 'config update applied' hint.
- server.rs::HostRequest::Rebuild — the admin-CLI direct path
  calls lifecycle::rebuild bypassing rebuild_agent. add kick
  on success.

dashboard's restart / start lifecycle_action extras still
kick via their own closures since they don't route through
rebuild_agent. stop / kill / destroy intentionally don't
kick — there's nothing to wake.

hive-c0re/src/dashboard.rs

@@ -1093,7 +1093,9 @@ async fn post_rebuild(State(state): State<AppState>, AxumPath(name): AxumPath<St
             let rev = current_rev.clone();
             async move { crate::auto_update::rebuild_agent(&coord, &n, &rev).await }
         },
-        |s, n| s.coord.kick_agent(n, "container rebuilt"),
+        // rebuild_agent fires kick_agent on success itself, so the
+        // extra-closure is a no-op here.
+        |_, _| {},
     )
     .await
 }