refactor(#2390): split provision out of the create node in the spawn dag

hive-c0re/src/lifecycle/mod.rs

@@ -226,11 +226,13 @@ pub async fn spawn(name: &str, hive: &HiveEnv, paths: &AgentPaths) -> Result<()>
     priv_run("start", name).await
 }
 
-/// First-spawn provisioning + `nixos-container create`, without the
-/// drop-in write or the start — the job queue's `Create` node.
-/// `spawn` composes this with `write_dropins` + start for direct
-/// callers (root-agent bootstrap).
-pub async fn create_container(name: &str, hive: &HiveEnv, paths: &AgentPaths) -> Result<()> {
+/// First-spawn pre-create provisioning — the job queue's `Provision`
+/// node. Fail fast on a port collision, set up the proposed/applied
+/// repos + state subvolume + claude/notes dirs, then register the new
+/// agent in the meta flake (`sync_agents`) so the later
+/// `nixos-container create --flake meta#<name>` ref resolves. Does NOT
+/// create the container — that's `create_only` / the `Create` node.
+pub async fn provision_container(name: &str, hive: &HiveEnv, paths: &AgentPaths) -> Result<()> {
     validate(name)?;
     if let Some(other) = port_collision(name).await {
         bail!(
@@ -247,10 +249,25 @@ pub async fn create_container(name: &str, hive: &HiveEnv, paths: &AgentPaths) ->
     // before `nixos-container create` so the `--flake meta#<name>`
     // ref resolves.
     let agents = agents_after_spawn(name).await?;
-    crate::meta::sync_agents(hive, &agents).await?;
+    crate::meta::sync_agents(hive, &agents).await
+}
+
+/// The `nixos-container create` proper — the job queue's `Create` node.
+/// Assumes `provision_container` already registered the agent in meta.
+pub async fn create_only(name: &str) -> Result<()> {
     priv_run("create", name).await
 }
 
+/// First-spawn provisioning + `nixos-container create`, without the
+/// drop-in write or the start. `spawn` composes this with
+/// `write_dropins` + start for direct callers (root-agent bootstrap);
+/// the job queue instead runs `provision_container` (`Provision` node)
+/// and `create_only` (`Create` node) as separate DAG steps.
+pub async fn create_container(name: &str, hive: &HiveEnv, paths: &AgentPaths) -> Result<()> {
+    provision_container(name, hive, paths).await?;
+    create_only(name).await
+}
+
 /// Rebuild-path preamble shared by the job queue's `Prebuild` node and
 /// `rebuild_no_meta`: fail fast on a port collision, then make sure
 /// the applied repo + state dirs exist. Container untouched.