harness: remove deprecated manager-side request_spawn surface (closes #442)

hive-c0re/src/rebuild_queue.rs

@@ -568,16 +568,19 @@ async fn dispatch(
             crate::actions::run_approval_spawn(coord, Some(entry.id), approval_id).await
         }
         (QueueKind::Spawn, None) => {
-            // No non-approval Spawn caller today. The variant exists so
-            // operator-triggered `RequestSpawn` (deprecated) and the
-            // future direct-spawn admin path can route through here
-            // without a wire change.
-            tracing::debug!(
-                id = entry.id,
-                agent = %entry.agent,
-                "rebuild_queue: Spawn entry without approval_id is a no-op"
-            );
-            Ok(())
+            // Unreachable today: every Spawn entry is born from an
+            // approval (HostRequest::RequestSpawn → submit_kind →
+            // approve → enqueue with approval_id). The manager-side
+            // `RequestSpawn` surface that used to bypass approvals
+            // was removed in #442; if a future direct-spawn admin
+            // path needs to skip the approval ride it should wire
+            // its own action call rather than route through here.
+            anyhow::bail!(
+                "rebuild_queue: Spawn entry id={} agent={} arrived without an approval_id — \
+                 nothing should enqueue this shape today",
+                entry.id,
+                entry.agent,
+            )
         }
         (QueueKind::Destroy, _) => {
             // Reserved for future `destroy --purge` integration.