job_queue: fix the boot sweep's lost declarations, drop the node wrapper

Two review findings on the resources-at-construction change.

argus: `workers::auto_update`'s boot sweep constructs nodes through
`templates::node` too, and it was not converted. With the kind-derived
declaration gone, its sweep `MetaLock` and its per-agent `Reconcile`
silently declared no resources at all — so a boot reconcile no longer
held the agent lease and could race another DAG's container ops, and the
sweep's meta commit could land inside another node's staged deploy
window. Nothing failed to compile: removing an implicit behaviour from a
helper is invisible at every call site that relied on it.

The declarations now live in a pure `boot_nodes`, split out of
`submit_boot_tree` so they can be exercised without a `Coordinator`.
That path is the only place job nodes are built outside `job_queue/`,
which is exactly why it had no coverage; `boot_sweep_nodes_declare_
their_own_resources` closes that, asserting against declared graph edges
rather than against the kind.

mara: `templates::node` is a redundant redirect now that it no longer
derives resources — deleted, and its 43 call sites use `Job::node`
directly. The reasoning it documented moved to the module docs of
`templates.rs` and `resource.rs`, which is where it stays true.

hive-c0re/src/job_queue/exec.rs

@@ -424,7 +424,7 @@ async fn run_reconcile(coord: &Arc<Coordinator>, claim: &Claim) -> Result<NodeOu
         // node rather than to the fact that a `Reconcile` happens to fan it out.
         let lease = Resource::Agent(kind.agent().to_owned());
         vec![Box::new(move |b: &super::Job| {
-            let _ = super::templates::node(b, kind).needs(lease);
+            let _ = b.node(kind).needs(lease);
         }) as Declare]
     };
     let append_subgraph = match reconcile_action(wanted, running) {