job_queue: declare a node's resources where the node is constructed

Resources were derived from the node's kind: `templates::node` called
`NodeKind::resource_deps()`, which fanned out to `needs_build_slot` /
`needs_lease` / `needs_meta_window`. That made the requirement a property
of the *kind*, so a kind that happened to run under an ancestor already
holding the resource could get away with declaring nothing.

Three did. `Start`, `Stop` and `PostSwap` appear in none of the three
predicates, and that was only safe because one construction site fans
them out from inside a lease-holding `Reconcile` — a fact about today's
DAG shape, not about the nodes.

Each of the 41 construction sites now says what it holds. `Start` /
`Stop` / `PostSwap` declare the agent lease; per the contract that is a
re-entrant borrow, which a new test pins rather than argues.

`running_transients` reads the node's declared deps instead of
re-deriving from the kind. That closes the blank-pill gap: the pill went
blank during container start, stop and the post-swap tail because the
declaration was missing, not because the filter was wrong.

The deleted predicates carried the only written record of three design
decisions; each moved to the `Resource` variant it constrains rather than
dying with its function.

docs/coordinator.md

@@ -75,7 +75,7 @@ container build:
   resource declared by every node kind that mutates the meta repo — `MetaSync`,
   `MetaLock`, `WritePermFile`, `Reparent`, `Provision`'s agent registration, and
   `DeployWindow` — the deploy subtree's root, which holds it across every
-  phase below it (`NodeKind::needs_meta_window`). Two meta
+  phase below it (it declares `Resource::MetaWindow`). Two meta
   mutations can therefore never interleave, so no commit lands inside another
   node's staged window. It is a queue resource rather than a runtime mutex
   because a resource is held by a subtree root across its whole subtree, which