hive-c0re: push HelperEvent::Spawned as a todo, not a broker message

Follow-up from #2955 (mara: 'make core able to give agent a todo').
First migration slice: Spawned was pure FYI-check-when-convenient
material, not something needing an immediate turn.

Coordinator::push_todo/push_todo_submitter do a best-effort live dial
of the target agent's own hive-agent-sock (hive_host_sock::agent_todo_
socket), sending the exact UpsertTodo request in-container producers
(matrix/bash/forge-notify) already send. Push, not queue: agent
offline (socket absent) or dial failure is a silent no-op, no retry,
no fallback delivery -- matches mara's 'not available if offline'
call exactly.

HelperEvent::Spawned removed entirely (enum variant + all 3 call
sites migrated: handle_spawn's two arms, finish_approval's Spawn
approval-kind arm) rather than kept alongside a translation layer --
per mara's correction on the first design attempt, migrating the
producer means deleting the old path, not bridging it.

Verified: cargo build/clippy/test -p hive-c0re -p hive-host-sock
-p hive-sh4re clean (318 tests), nix fmt clean.

hive-host-sock/src/lib.rs

@@ -72,6 +72,20 @@ pub fn agent_web_socket(name: &Ident) -> PathBuf {
         .join("web.sock")
 }
 
+/// Per-agent in-container todo socket path —
+/// `AGENT_SOCKET_DIR/<name>/agent.sock`. Same socket the harness's
+/// `HIVE_AGENT_SOCKET` binds and in-container producers (matrix/bash/
+/// forge-notify) already dial — `hive-c0re` uses this to push a todo
+/// directly into a *running* agent's local store (see
+/// `Coordinator::push_todo`); the container being down (socket absent)
+/// means the push is simply skipped, not queued.
+#[must_use]
+pub fn agent_todo_socket(name: &Ident) -> PathBuf {
+    PathBuf::from(AGENT_SOCKET_DIR)
+        .join(name.as_str())
+        .join("agent.sock")
+}
+
 /// nspawn machine-name prefix for agent containers (`h-<name>`). A single
 /// `starts_with(AGENT_PREFIX)` filter enumerates managed containers.
 pub const AGENT_PREFIX: &str = "h-";