job_queue: fix the boot sweep's lost declarations, drop the node wrapper

Two review findings on the resources-at-construction change.

argus: `workers::auto_update`'s boot sweep constructs nodes through
`templates::node` too, and it was not converted. With the kind-derived
declaration gone, its sweep `MetaLock` and its per-agent `Reconcile`
silently declared no resources at all — so a boot reconcile no longer
held the agent lease and could race another DAG's container ops, and the
sweep's meta commit could land inside another node's staged deploy
window. Nothing failed to compile: removing an implicit behaviour from a
helper is invisible at every call site that relied on it.

The declarations now live in a pure `boot_nodes`, split out of
`submit_boot_tree` so they can be exercised without a `Coordinator`.
That path is the only place job nodes are built outside `job_queue/`,
which is exactly why it had no coverage; `boot_sweep_nodes_declare_
their_own_resources` closes that, asserting against declared graph edges
rather than against the kind.

mara: `templates::node` is a redundant redirect now that it no longer
derives resources — deleted, and its 43 call sites use `Job::node`
directly. The reasoning it documented moved to the module docs of
`templates.rs` and `resource.rs`, which is where it stays true.

hive-c0re/src/workers/auto_update.rs

@@ -318,6 +318,49 @@ pub async fn run(coord: Arc<Coordinator>) -> Result<()> {
     Ok(())
 }
 
+/// The boot DAG's node declarations, split out of [`submit_boot_tree`] so they
+/// can be exercised without a live [`Coordinator`].
+///
+/// That split is not cosmetic: this path constructs nodes outside
+/// `job_queue/`, so it is the one place a resource declaration can be forgotten
+/// without any in-module test noticing. It has happened once already — the
+/// sweep `MetaLock` and the boot `Reconcile`s silently declared nothing when
+/// kind-derived resources were removed, which drops the agent lease a boot
+/// reconcile needs to not race another DAG's container ops.
+pub(crate) fn boot_nodes(
+    b: &crate::job_queue::Job,
+    any_stale: bool,
+    fanout: Vec<String>,
+    drifted: Vec<String>,
+) {
+    use crate::job_queue::NodeKind;
+    use crate::job_queue::resource::Resource;
+
+    // Sweep whenever ANY marker is stale — even when every stale agent is
+    // wanted-offline: the hyperhive lock bump must land now so their later
+    // start-upgrade rebuilds build against it. No stale agents ⇒ no MetaLock
+    // ⇒ no meta commit on a no-change boot. The `fanout` list rides the
+    // MetaLock into `run_meta_lock`, which appends the rebuild subgraphs.
+    if any_stale {
+        let _ = b
+            .node(NodeKind::MetaLock {
+                sweep: true,
+                fanout: Some(fanout),
+                // A sweep bumps `hyperhive` alone (`lock_update_hyperhive`),
+                // so it names no inputs.
+                inputs: Vec::new(),
+            })
+            .needs(Resource::BuildSlot)
+            .needs(Resource::MetaWindow);
+    }
+    // One boot Reconcile per drifted agent — independent roots.
+    for name in drifted {
+        // Name the lease before the agent string moves into the kind.
+        let lease = Resource::Agent(name.clone());
+        let _ = b.node(NodeKind::Reconcile { agent: name }).needs(lease);
+    }
+}
+
 /// Submit this boot's work as **one DAG** (no anchor node, no per-agent
 /// child DAGs). Node 0 is the sweep `MetaLock` (only when
 /// something is stale) — its executor bumps the hyperhive lock, then grows
@@ -334,7 +377,7 @@ fn submit_boot_tree(
     n_deferred: usize,
     n_skipped: usize,
 ) {
-    use crate::job_queue::{DagSpec, NodeKind, Source, templates};
+    use crate::job_queue::{DagSpec, Source};
 
     // Fully-quiet boot (nothing stale, nothing drifted) submits nothing.
     if !any_stale && drifted.is_empty() {
@@ -348,29 +391,8 @@ fn submit_boot_tree(
         n_skipped,
     );
 
-    let declare: crate::job_queue::Declare = Box::new(move |b| {
-        // Sweep whenever ANY marker is stale — even when every stale agent is
-        // wanted-offline: the hyperhive lock bump must land now so their later
-        // start-upgrade rebuilds build against it. No stale agents ⇒ no MetaLock
-        // ⇒ no meta commit on a no-change boot. The `fanout` list rides the
-        // MetaLock into `run_meta_lock`, which appends the rebuild subgraphs.
-        if any_stale {
-            let _ = templates::node(
-                b,
-                NodeKind::MetaLock {
-                    sweep: true,
-                    fanout: Some(fanout),
-                    // A sweep bumps `hyperhive` alone (`lock_update_hyperhive`),
-                    // so it names no inputs.
-                    inputs: Vec::new(),
-                },
-            );
-        }
-        // One boot Reconcile per drifted agent — independent roots.
-        for name in drifted {
-            let _ = templates::node(b, NodeKind::Reconcile { agent: name });
-        }
-    });
+    let declare: crate::job_queue::Declare =
+        Box::new(move |b| boot_nodes(b, any_stale, fanout, drifted));
 
     let spec = DagSpec {
         // The sweep's own rebuild subgraphs emit their `Rebuilt` events as they