kick_agent on every rebuild + apply path

agents weren't being woken with the 'you were rebuilt — check
/state/ for notes, --continue intact' system message after
several recent rebuild surfaces:

- auto_update::rebuild_agent — used by the dashboard rebuild
  button, admin-CLI rebuild via lifecycle_action, the startup
  rev-scan, AND the new meta-input update batch loop. kick
  moves *into* rebuild_agent's success arm so all four
  paths benefit. (the dashboard's lifecycle_action extra
  closure was already firing kick — now it's a no-op for the
  rebuild path since rebuild_agent does it.)
- actions::run_apply_commit — apply-commit approve flow built
  + tagged deployed/<id> but never kicked. add kick on
  success with the more specific 'config update applied' hint.
- server.rs::HostRequest::Rebuild — the admin-CLI direct path
  calls lifecycle::rebuild bypassing rebuild_agent. add kick
  on success.

dashboard's restart / start lifecycle_action extras still
kick via their own closures since they don't route through
rebuild_agent. stop / kill / destroy intentionally don't
kick — there's nothing to wake.

hive-c0re/src/server.rs

@@ -147,13 +147,20 @@ async fn dispatch(req: &HostRequest, coord: Arc<Coordinator>) -> HostResponse {
                 // agent.nix). Without this the admin-socket CLI was
                 // a notify-gap.
                 match &result {
-                    Ok(()) => coord.notify_manager(&hive_sh4re::HelperEvent::Rebuilt {
-                        agent: name.clone(),
-                        ok: true,
-                        note: None,
-                        sha: None,
-                        tag: None,
-                    }),
+                    Ok(()) => {
+                        coord.notify_manager(&hive_sh4re::HelperEvent::Rebuilt {
+                            agent: name.clone(),
+                            ok: true,
+                            note: None,
+                            sha: None,
+                            tag: None,
+                        });
+                        // Wake the agent's next turn with the
+                        // "you were rebuilt" hint. Same pattern as
+                        // auto_update::rebuild_agent and the dashboard
+                        // rebuild path — this is the CLI's equivalent.
+                        coord.kick_agent(name, "container rebuilt");
+                    }
                     Err(e) => coord.notify_manager(&hive_sh4re::HelperEvent::Rebuilt {
                         agent: name.clone(),
                         ok: false,