feat(#1086): serialize perm changes through rebuild queue

add QueueKind::PermChange — dashboard tool-group and capability
handlers no longer write the shared JSON files inline. instead they
enqueue a PermChange entry; the FIFO worker applies the file write
then calls rebuild_agent so the updated env var takes effect.

concurrent batch-apply actions for different agents previously raced
on tool-groups.json / capabilities.json (last write wins, earlier
change silently dropped). serialising through the queue prevents this.

dedup check extended with perm-type discriminant so tool-groups and
capabilities changes for the same agent are kept as distinct entries
and never collapse into one slot.

hive-c0re/src/actions.rs

@@ -54,6 +54,7 @@ pub async fn approve(coord: Arc<Coordinator>, id: i64) -> Result<()> {
                 None,
                 Vec::new(),
                 Some(id),
+                None,
             );
             coord.emit_rebuild_queue_snapshot();
             Ok(())
@@ -72,6 +73,7 @@ pub async fn approve(coord: Arc<Coordinator>, id: i64) -> Result<()> {
                 None,
                 inputs.clone(),
                 Some(id),
+                None,
             );
             // Pre-enqueue cascade rebuilds in topological order so
             // agents depending on updated inputs are rebuilt after the
@@ -99,6 +101,7 @@ pub async fn approve(coord: Arc<Coordinator>, id: i64) -> Result<()> {
                 None,
                 Vec::new(),
                 Some(id),
+                None,
             );
             coord.emit_rebuild_queue_snapshot();
             Ok(())