job_queue: add NodeKind::Reparent (topology moves as a queue node, #2719)

docs/coordinator.md

@@ -54,6 +54,7 @@ Cheap — no build slot:
 | `Drain`         | await the harness clearing the fence, bounded by the 3-min graceful-stop timeout; resolves ok either way                              |
 | `WriteDropin`   | `set_nspawn_flags` + `set_resource_limits` + daemon-reload                                                                            |
 | `WritePermFile` | commit `tool-groups.json` / `capabilities.json` (single git commit under `META_LOCK`) + emit the P3RM1SS10NS snapshots                |
+| `Reparent`      | `set-parent` / `set-parent-bulk`: apply every `(child, new_parent)` move under one `META_LOCK` commit (`meta::bulk_commit_topology`), send the per-agent move notifications, rescan + diff-emit. Agentless like `MetaLock` — a bulk move can span multiple agents, and a reparent touches the meta repo, not any one container. `moves` is `(Ident, Option<Ident>)` pairs, not raw strings — mara: "use Ident type instead of string" (#2719, issuecomment 42691). Rides `Template::MetaUpdate` rather than a dedicated `Template` variant — that enum is on its way out (see `#2665`, still open/blocked on a scope question) and is already internal-only (not on `DagView`'s wire shape), so the stand-in only affects `terminal_hook` dispatch (resolves to no hook either way) and history-retention bucketing |
 
 There is deliberately **no `GitCommit` node**: `meta.rs` fuses each mutation
 with its commit under its internal `META_LOCK` mutex, so a standalone commit
@@ -66,7 +67,7 @@ container build:
 
 - **The deploy window** (`Resource::MetaWindow`): a global, capacity-1 queue
   resource declared by every node kind that mutates the meta repo — `MetaSync`,
-  `MetaLock`, `WritePermFile`, `Provision`'s agent registration, and
+  `MetaLock`, `WritePermFile`, `Reparent`, `Provision`'s agent registration, and
   `DeployWindow` — the deploy subtree's root, which holds it across every
   phase below it (`NodeKind::needs_meta_window`). Two meta
   mutations can therefore never interleave, so no commit lands inside another
@@ -122,6 +123,7 @@ perm-change(a):    WritePermFile(a) → «rebuild subgraph»
 meta-update(inp):  MetaLock(inp) →(in-DAG) «rebuild subgraph» per affected agent
 boot:              (if any rev marker stale) MetaLock(hyperhive) →(in-DAG) «rebuild subgraph» per stale agent;
                    plus Reconcile(a) for every drifted agent  (all ONE DAG)
+reparent(moves):   Reparent(moves)   (no rebuild — topology.json is read live)
 ```
 
 Notable collapses:
@@ -190,7 +192,7 @@ resources are free. Resources:
    write, not a container op, but takes the lease anyway so a power-op DAG's
    intent write + reconcile is atomic — two racing ops can't clobber intent
    before either reconciles.) **Lease-exempt**: `MetaSync`, `Prebuild`,
-   `MetaLock`, `WritePermFile` —
+   `MetaLock`, `WritePermFile`, `Reparent` —
    they touch the store / meta, not the running container, which is exactly
    why a stop can land while another DAG's prebuild is still building.