wip(#3001): convert the last submit call sites; the binary compiles again

`server.rs`'s five sites move to `power::{stop,start,restart}_many` and direct
template inserts. `submit_single` routes through the `*_many` builders with a
one-element slice rather than keeping a parallel single-target shape.

`templates::rebuild` and `templates::reparent` now return the guids of the roots
they declare, so a caller that has to wait on them can name them; previously
only the void-returning form existed and every caller got an empty id list.

Two comments corrected while converting, both contradicted by the code they sit
above:

* `templates::rebuild` said its tail is edged onto "(MetaSync, Prebuild,
  Reconcile)" and that "Prebuild's roll-up carries the subtree" — the brace has
  been the middle root since the AgentWindow change.
* the restart handler described the per-agent shape as starting with SetWanted,
  while `restart_chain`'s own doc says a restart never rewrites `wanted` — that
  is the difference between restart and stop/start.

Error handling is no longer swallowed: a failed insert becomes a reported error
rather than a silently-absent id.

hive-c0re/src/job_queue/templates.rs

@@ -317,13 +317,22 @@ pub(crate) fn deploy_rebuild_nodes(builder: &JobBuilder, agent: &str, approval_i
 /// children.
 ///
 /// Closed by an [`NodeKind::EmitRebuilt`] tail edged onto all three group-roots
-/// (`MetaSync`, `Prebuild`, `Reconcile`) — `Prebuild`'s roll-up carries the
-/// whole `StopForUpdate`→`Swap`→`RebuildBookkeeping` subtree, so those three cover every
-/// node. Edging `Reconcile` alone would not do: it is `AfterAny` `Prebuild`, so
-/// it reaches `Done` even after a failed swap and the tail would report success.
-pub fn rebuild(builder: &JobBuilder, agent: &str, relock: bool) {
+/// (`MetaSync`, the `AgentWindow` brace, `Reconcile`) — the brace's roll-up
+/// carries the whole `StopForUpdate`→`Swap`→`RebuildBookkeeping` subtree, so
+/// those three cover every node. Edging `Reconcile` alone would not do: it is
+/// `AfterAny` the brace, so it reaches `Done` even after a failed swap and the
+/// tail would report success.
+///
+/// Returns those three roots, so a caller that needs to wait on the rebuild can
+/// name them.
+pub fn rebuild(builder: &JobBuilder, agent: &str, relock: bool) -> Vec<hive_jobq::NodeGuid> {
     let roots = rebuild_nodes(builder, agent, relock, None);
     emit_rebuilt_tails(builder, agent, &roots.all());
+    vec![
+        roots.meta_sync.guid(),
+        roots.agent_window.guid(),
+        roots.reconcile.guid(),
+    ]
 }
 
 /// Approval-driven deploy (`MergeConfigPr`) as a phase subtree rather than the
@@ -483,10 +492,16 @@ pub fn meta_update(builder: &JobBuilder, inputs: Vec<String>, approval_id: Optio
 /// checks), so a parent move needs no container rebuild to take effect.
 /// No transient pill either — the node is agentless (no lease to hang one
 /// off of) and near-instant. No tail node: the write is the whole effect.
-pub fn reparent(builder: &JobBuilder, moves: Vec<(hive_types::Ident, Option<hive_types::Ident>)>) {
-    let _reparent = builder
+///
+/// Returns the single node's guid so a caller can wait on it.
+pub fn reparent(
+    builder: &JobBuilder,
+    moves: Vec<(hive_types::Ident, Option<hive_types::Ident>)>,
+) -> hive_jobq::NodeGuid {
+    builder
         .node(NodeKind::Reparent { moves })
-        .needs(Resource::MetaWindow);
+        .needs(Resource::MetaWindow)
+        .guid()
 }
 
 // The boot is assembled inline in `workers/auto_update.rs::submit_boot_tree`