jobq: Scheduler::new_job is gone

It handed out exactly the builder JobBuilder::new is pub(crate) to
withhold, which was agreed against more than once. I had left it in
place with a docstring naming it as the hole and folded the fix into an
open question. It was not an open question.

It only survived because two hive-c0re tests minted a builder by hand to
simulate a MetaLock growing its cascade. The grown thing is a template,
so the fix is the same as for the deploy graft and the reconcile
fan-out: call it.

exec.rs's MetaLock arm looped rebuild_nodes inline -- the second and last
construction site declaring nodes inside an executor. It is now
templates::grown_rebuilds, so a test can assert what a sweep declares by
calling the same function production calls.

grown_subgraph_roots_on_emitter_and_rebases_local_deps and
meta_update_grows_cascade_in_dag differed only in RebuildOpts; they are
one test over the declared shape, checking a root chain per agent, a
build each, and a drain each because a boot sweep is graceful.

With those gone, CompleteNode::new_job, CompleteNode::complete_node_growing
and drain_meta_syncs had no callers either. hive-jobq's own two growth
tests use JobBuilder::new() directly -- in-crate, so the wall holds.
grep for new_job across the workspace now returns nothing.

hive-c0re/src/job_queue/templates.rs

@@ -80,6 +80,22 @@ fn resolve_approval_tails(b: &Job, approval_id: i64, root: Handle<'_>) {
     }
 }
 
+/// Declare one rebuild subgraph per agent onto the builder a running
+/// [`NodeKind::MetaLock`] was handed.
+///
+/// **Into the emitter's own builder, not as new DAGs.** Growing in-DAG is what
+/// roots each subgraph on the `MetaLock`, so the whole sweep (or meta-update
+/// cascade) stays one unit of work the operator can watch and cancel, and every
+/// rebuild builds against the lock the emitter just bumped.
+///
+/// Same reason as [`fanned_out_mechanical`] for living here: this was the
+/// second construction site declaring nodes inline in an executor.
+pub(crate) fn grown_rebuilds(b: &Job, agents: &[String], opts: RebuildOpts) {
+    for agent in agents {
+        rebuild_nodes(b, agent, opts, None);
+    }
+}
+
 /// Declare the mechanical node a [`NodeKind::Reconcile`] planner fans out
 /// (`Start` / `Stop`) onto the builder it was handed while running.
 ///