jobq: templates swallow the DagSpec layer

DagSpec described the graph the templates were about to build, one layer
below the templates themselves. Per #2972 the templates should be that
unit, so the spec type is gone and every declarer writes onto the job
builder directly.

- delete DagSpec<F> and its hand-written Debug impl
- submit(source, reason, declare: impl FnOnce(&Job)) replaces the
  pre-built-spec signature; submit_and_emit follows
- all six templates take &Job; the Source is now the caller's to pass,
  which spawn and approval_deploy previously hardcoded while the other
  four did not
- power_dag dissolves into stop_nodes/start_nodes/restart_nodes, which
  borrow their targets instead of owning them

315 tests pass unchanged.

hive-c0re/src/job_queue/mod.rs

@@ -47,7 +47,7 @@ use hive_jobq_wire::{GraphNode, GraphWire};
 use tokio::sync::Notify;
 
 pub use hive_jobq::TerminalState;
-pub use model::{DagSpec, DagView, NodeKind, PermPayload, Source, State};
+pub use model::{DagView, NodeKind, PermPayload, Source, State};
 use resource::Resource;
 
 /// A job under construction: `hive_jobq`'s builder over this queue's payload
@@ -208,27 +208,34 @@ impl JobQueue {
     /// here completes it by hand — a node with no work of its own still goes
     /// the way every other node goes.
     ///
-    /// Takes the spec's recipe by generic, not as a boxed closure: a spec
-    /// travels from the template that built it directly into this call, so
-    /// there is nothing to allocate for.
+    /// `source` and `reason` are the container node's own payload — they are
+    /// arguments here rather than fields of a spec struct because that is all
+    /// they ever were. `declare` is the recipe, taken by generic and run
+    /// against a builder `hive_jobq` owns: it goes from the template straight
+    /// into this call, so there is nothing to allocate for.
     ///
     /// # Errors
     /// Propagates a graph-insert error (dependencies that aren't
     /// dependency-topological).
-    pub fn submit<F: FnOnce(&Job)>(&self, spec: DagSpec<F>) -> anyhow::Result<u64> {
+    pub fn submit(
+        &self,
+        source: Source,
+        reason: String,
+        declare: impl FnOnce(&Job),
+    ) -> anyhow::Result<u64> {
         let mut inner = self.lock();
         let container = inner
             .append(
                 NodeKind::Dag {
-                    source: spec.source,
-                    reason: spec.reason,
+                    source,
+                    reason,
                     created_at: Utc::now(),
                 },
                 Vec::new(),
                 None,
             )
             .map_err(|e| anyhow::anyhow!("job_queue: container insert failed: {e}"))?;
-        insert_group(&mut inner, spec.declare, Some(container))?;
+        insert_group(&mut inner, declare, Some(container))?;
         drop(inner);
         self.notify.notify_one();
         Ok(container.get())