docs+prompt: tag-driven flow + /applied RO mount

manager prompt: explain that arbitrary files now travel with
the proposal, document the /applied/<n>/.git RO mount and the
tag scheme (git show applied/deployed/<id> etc.), call out
that applied/main only advances on deployed so a failed build
isn't terminal. approvals.md: drop the old per-agent
applied.git phrasing in favour of the single /applied RO
bind, mention both manager binds together. claude.md
scratchpad flips from in-flight to just-landed.

docs/approvals.md

@@ -95,14 +95,17 @@ rejected and failed trees stay browsable forever — `git log
 
 ### Manager view of applied
 
-`/agents/<n>/applied.git` is a **read-only bind-mount** of
-`/var/lib/hyperhive/applied/<n>/.git` inside the manager
-container. The manager fetches tags into its proposed clone
-(`git fetch /agents/<n>/applied.git refs/tags/*:refs/tags/applied/*`)
-and `git show` any deployed / failed / denied tree to see what
-actually shipped, what error blocked the last build, or what
-note the operator left on a denial. The RO mount means git
-plumbing inside the manager cannot corrupt the applied repo.
+`/applied/` is a **read-only bind-mount** of
+`/var/lib/hyperhive/applied/` (the entire tree) inside the
+manager container. The manager fetches tags into its proposed
+clone with `git fetch /applied/<n>/.git
+'refs/tags/*:refs/tags/applied/*'` and `git show` any
+deployed / failed / denied tree to see what actually shipped,
+what error blocked the last build, or what note the operator
+left on a denial. The RO bind means git plumbing inside the
+manager cannot corrupt the applied repos — and a single mount
+covers every agent (existing + future) without rebuilding the
+manager on each spawn.
 
 ## Migration from the pre-tag scheme
 
@@ -131,9 +134,11 @@ Differences from sub-agents:
   (vs `agent-base`).
 - Container name is `hm1nd` (no `h-` prefix).
 - Fixed web UI port (`MANAGER_PORT = 8000`).
-- `set_nspawn_flags` adds an extra bind:
-  `/var/lib/hyperhive/agents` → `/agents` (RW), so the manager can
-  edit per-agent proposed repos.
+- `set_nspawn_flags` adds two extra binds: `/var/lib/hyperhive/agents`
+  → `/agents` (RW) so the manager can edit per-agent proposed repos,
+  and `/var/lib/hyperhive/applied` → `/applied` (RO) so the manager
+  can `git fetch` deployed/failed/denied tags from any agent's
+  authoritative applied repo (see "Manager view of applied" below).
 - First-deploy spawn bypasses the approval queue (manager is
   required infrastructure).
 - Per-agent socket lives at `/run/hyperhive/manager/`, owned by