fix(#1115): commit perm+topology changes under META_LOCK to prevent dirty working tree

hive-c0re/src/rebuild_queue.rs

@@ -670,17 +670,20 @@ async fn dispatch(
         }
         (QueueKind::PermChange, _) => {
             let name = &entry.agent;
-            // Apply the file write first — serialised here so concurrent
-            // dashboard batch-apply actions never race on the shared JSON.
-            coord.set_queue_step(Some(entry.id), "writing perm file");
+            // Write + commit the perm file under META_LOCK so the
+            // working tree is never left dirty between the file write
+            // and the subsequent prepare_deploy git operations.
+            coord.set_queue_step(Some(entry.id), "writing + committing perm file");
             match &entry.perm_payload {
                 Some(PermPayload::ToolGroups { groups }) => {
-                    crate::tool_groups::set_groups(name, groups)
-                        .with_context(|| format!("set tool-groups for {name}"))?;
+                    crate::meta::commit_tool_groups(name, groups)
+                        .await
+                        .with_context(|| format!("commit tool-groups for {name}"))?;
                 }
                 Some(PermPayload::Capabilities { caps }) => {
-                    crate::capabilities::set_caps(name, caps)
-                        .map_err(|e| anyhow::anyhow!("set capabilities for {name}: {e}"))?;
+                    crate::meta::commit_capabilities(name, caps)
+                        .await
+                        .with_context(|| format!("commit capabilities for {name}"))?;
                 }
                 None => {
                     anyhow::bail!(