docs(#3034): give the brace one home instead of five

Measured after mara's "2/3 of this is docs, most of it duplicated": 243 of 380
added .rs lines were comments. The brace rationale was written out in full in
`model.rs`, the `templates.rs` module header, `quiesce`, `rebuild_subtree` and
`docs/coordinator.md` — five copies of one argument, which is why four docs
needed correcting earlier in this branch. Correcting every copy preserves the
thing that made them go stale.

`docs/coordinator.md` (_Braces_) is now the single home. The rest state what a
node *is* and point there. Also drops the per-operation DAG diagram from the
`templates.rs` header, which the same doc already carries, and cuts
`rebuild_subtree`'s node-by-node walkthrough down to the three choices a reader
would otherwise undo — the code below it is the source of truth for the shape.

Comments -59 lines, no behaviour change, 317 tests unchanged.

hive-c0re/src/job_queue/model.rs

@@ -159,36 +159,14 @@ pub enum NodeKind {
     /// those phases does — the id is the node's own payload, not something a
     /// DAG-level catch-all hands down.
     DeployWindow { agent: String, approval_id: i64 },
-    /// Group root of a rebuild subtree, and the node that **owns the agent
-    /// lease** for every phase below it. Performs no work of its own — same
-    /// pure-resource-holder shape as [`NodeKind::DeployWindow`], scoped to one
-    /// agent instead of a whole deploy.
+    /// Group root of a rebuild subtree — the **brace**: declares the agent
+    /// lease and the build slot, holds both for the whole subtree, and performs
+    /// no work of its own. Same pure-resource-holder shape as
+    /// [`NodeKind::DeployWindow`], scoped to one agent.
     ///
-    /// It exists so the lease is held *continuously* across the build, the
-    /// graceful-stop window and the swap. That is what lets `Prebuild` and the
-    /// `Signal` → `Drain` stop window run **concurrently**: they contend for
-    /// different resources (a build slot vs. the agent), and without a brace
-    /// the only way to order the stop after the build was to nest it under
-    /// `Prebuild` — which hid the whole graceful-stop timeout behind the nix
-    /// build, per agent, on every sweep.
-    ///
-    /// ⚠️ Its children deliberately **do not declare
-    /// [`Resource::Agent`](super::resource::Resource::Agent)**. Declaring a
-    /// resource means "I need this exclusively", and the lease is single-unit —
-    /// two siblings that both declared it could never run in parallel, which is
-    /// the entire point of the brace. Holding it on the parent and omitting it
-    /// on coordinated children is the opt-in "this subtree knows what it is
-    /// doing" shape.
-    ///
-    /// This costs nothing in observability: `running_transients` keys off the
-    /// node's **payload** agent, not off a declared lease edge, so every child
-    /// still lights its own pill and still reports its own
-    /// [`NodeKind::takes_container_down`] to the crash watcher.
-    ///
-    /// Sits *after* `MetaSync` rather than under it — a parent holds its
-    /// resources for its whole subtree, so nesting this inside `MetaSync` would
-    /// pin the **global** meta window across every agent's build and serialise
-    /// the sweep.
+    /// Its children declare no resources and borrow these grants, which is what
+    /// lets `Prebuild` run beside the `Signal` → `Drain` window. Why braces
+    /// exist and what they cost: `docs/coordinator.md`, _Braces_.
     AgentWindow { agent: String },
     /// Deploy phase 1 — **verify only, mutates nothing.** Drift-gate the
     /// approval's PR head, fetch it into the applied repo, and eval-verify the
@@ -460,13 +438,10 @@ impl NodeKind {
         // - `Reconcile` is a planner; it fans out `Start` / `Stop`, which carry
         //   their own answer.
         // - `DeployWindow` brackets a deploy without itself stopping anything.
-        // - `AgentWindow` likewise. It is the one that looks wrong: it *parents*
-        //   `Signal` / `Drain` / `StopForUpdate` / `Swap`, which all answer
-        //   `true`. But this is per-node, not per-subtree, and every one of
-        //   those children is in `running_transients` on its own — so the
-        //   suppression window is exactly the span where a child that really
-        //   takes the container down is running, not the whole rebuild. Saying
-        //   `true` here would widen it to cover the build and the tail, where a
-        //   vanished container is still a real crash.
+        // - `AgentWindow` likewise, though it *parents* nodes that answer
+        //   `true`. This is per-node, not per-subtree, and each of those
+        //   children reports for itself — so `true` here would only widen
+        //   suppression over the build and tail, where a vanished container is
+        //   still a real crash.
     }
 }