refactor(#2449): write power intent via a SetWanted DAG node, not a pre-submit side effect

The durable 'wanted' power intent was written by submit::{start,stop,
restart,graceful_restart,graceful_stop} as a synchronous pre-submit side
effect, then read by the DAG's tail Reconcile. That's not crash-safe
(a crash between the write and the enqueue loses it) and, with agent now
per-node, can't be per-agent in a DAG that spans agents.

Move it into the DAG as a head SetWanted node:
- NodeKind::SetWanted { up } + run_set_wanted executor (fails the node on
  a write error, unlike the old warn-and-continue, so a stale intent
  never reaches Reconcile).
- LEASE-NEEDING, not lease-exempt: it takes the agent lease so a power-op
  DAG's intent-write + reconcile is atomic per-agent. If it were exempt,
  two racing ops (restart vs stop) would run both intent-writes up front
  and clobber each other before either reconciled — defeating the point
  of moving the write into the DAG. (In stale_start the lease is thus held
  across the head Prebuild, but that's a no-op there: the agent is down so
  prebuild is skipped.)
- templates: explicit SetWanted node 0 on restart/graceful_restart/
  graceful_stop, plus dedicated start/stop templates (SetWanted -> Reconcile)
  and stale_start (SetWanted(Up) -> rebuild subgraph, reusing rebuild_nodes).
  No compose helper / rebuild variant. reconcile_only is now boot-only.
- submit.rs: drop the set_wanted side effect; the stale-rev shape decision
  (start vs stale_start) stays submit-side.

All 33 job_queue tests pass (shape/lease tests updated for the head node).

hive-c0re/src/job_queue/exec.rs

@@ -98,9 +98,31 @@ pub(super) async fn run_node(coord: &Arc<Coordinator>, claim: &Claim) -> Result<
         // A pure grouping anchor (boot root): no work, completes immediately so
         // its child DAGs settle it and the boot tree resolves.
         NodeKind::Noop => Ok(NodeOutput::default()),
+        NodeKind::SetWanted { up } => run_set_wanted(coord, claim, *up),
     }
 }
 
+/// Write the agent's durable power intent — the DAG-node form of the old
+/// pre-submit `set_wanted` side effect. Store-only (no container touch), so
+/// build-slot-exempt; but it takes the agent's lifecycle lease (see
+/// `NodeKind::needs_lease`) so the whole power-op DAG is atomic per-agent.
+/// The downstream `Reconcile` reads the intent this writes. Unlike the old
+/// warn-and-continue write, a failed write fails the node (cancel-downstream
+/// cancels the `Reconcile`) rather than letting it converge to a stale
+/// intent — that atomicity is the point of moving it into the DAG.
+fn run_set_wanted(coord: &Arc<Coordinator>, claim: &Claim, up: bool) -> Result<NodeOutput> {
+    let wanted = if up {
+        crate::power::Wanted::Up
+    } else {
+        crate::power::Wanted::Offline
+    };
+    coord
+        .power
+        .set(&claim.agent, wanted)
+        .with_context(|| format!("set wanted={} for agent {}", wanted.as_str(), claim.agent))?;
+    Ok(NodeOutput::default())
+}
+
 /// Out-of-band toplevel build while the container keeps serving: meta
 /// sync + optional per-agent relock, then warm
 /// `system.build.toplevel` so the later `Swap` hits cache and skips