suppress crash_watch during background rebuilds + meta repoint

crash_watch fires ContainerCrash whenever it sees a previously-
running container in a non-running state without a transient
flag set. dashboard rebuilds already set Rebuilding via
lifecycle_action; the two other rebuild paths didn't:

- migrate::repoint_container: phase 4 walks every container,
  each nixos-container update activation briefly takes the
  systemd unit down. previously fired ContainerCrash for every
  agent during the migration; manager would then spuriously
  call start() on agents that were already coming back up.
- auto_update::rebuild_agent: startup scan + admin-socket
  caller bypass lifecycle_action.

both paths now set the Rebuilding transient around the rebuild
+ clear after. matches what dashboard does.

hive-c0re/src/auto_update.rs

@@ -59,6 +59,11 @@ pub async fn rebuild_agent(coord: &Arc<Coordinator>, name: &str, current_rev: &s
     let applied_dir = Coordinator::agent_applied_dir(name);
     let claude_dir = Coordinator::agent_claude_dir(name);
     let notes_dir = Coordinator::agent_notes_dir(name);
+    // Suppress crash_watch during the stop+start window inside
+    // lifecycle::rebuild. Dashboard rebuilds already do this via
+    // lifecycle_action; this catches the auto-update scan + any
+    // other direct caller.
+    coord.set_transient(name, crate::coordinator::TransientKind::Rebuilding);
     let result = lifecycle::rebuild(
         name,
         &coord.hyperhive_flake,
@@ -69,6 +74,7 @@ pub async fn rebuild_agent(coord: &Arc<Coordinator>, name: &str, current_rev: &s
         coord.dashboard_port,
     )
     .await;
+    coord.clear_transient(name);
     match &result {
         Ok(()) => {
             if let Err(e) = std::fs::write(rev_marker_path(name), current_rev) {