jobq: templates swallow the DagSpec layer

DagSpec described the graph the templates were about to build, one layer
below the templates themselves. Per #2972 the templates should be that
unit, so the spec type is gone and every declarer writes onto the job
builder directly.

- delete DagSpec<F> and its hand-written Debug impl
- submit(source, reason, declare: impl FnOnce(&Job)) replaces the
  pre-built-spec signature; submit_and_emit follows
- all six templates take &Job; the Source is now the caller's to pass,
  which spawn and approval_deploy previously hardcoded while the other
  four did not
- power_dag dissolves into stop_nodes/start_nodes/restart_nodes, which
  borrow their targets instead of owning them

315 tests pass unchanged.

hive-c0re/src/workers/auto_update.rs

@@ -109,12 +109,11 @@ pub async fn ensure_root_agent(coord: &Arc<Coordinator>) -> Result<()> {
             tracing::warn!(
                 "manager container exists but no applied flake — forcing rebuild to migrate"
             );
-            if let Err(e) = coord.job_queue.submit(crate::job_queue::templates::rebuild(
-                MANAGER_NAME,
+            if let Err(e) = coord.job_queue.submit(
                 crate::job_queue::Source::AutoUpdate,
                 "manager migration: no applied flake".to_owned(),
-                true,
-            )) {
+                |b| crate::job_queue::templates::rebuild(b, MANAGER_NAME, true),
+            ) {
                 tracing::warn!(error = ?e, "manager migration rebuild submit failed");
             }
         } else {
@@ -377,7 +376,7 @@ fn submit_boot_tree(
     n_deferred: usize,
     n_skipped: usize,
 ) {
-    use crate::job_queue::{DagSpec, Source};
+    use crate::job_queue::Source;
 
     // Fully-quiet boot (nothing stale, nothing drifted) submits nothing.
     if !any_stale && drifted.is_empty() {
@@ -391,19 +390,14 @@ fn submit_boot_tree(
         n_skipped,
     );
 
-    let declare = move |b: &crate::job_queue::Job| boot_nodes(b, any_stale, fanout, drifted);
-
-    let spec = DagSpec {
-        // The sweep's own rebuild subgraphs emit their `Rebuilt` events as they
-        // land; the boot DAG as a whole has no terminal side effect, so no tail.
-        source: Source::AutoUpdate,
-        reason,
-        // Rebuilding when the sweep will grow rebuild subgraphs (per-agent
-        // crash-watch suppression during their Swap, applied at claim time);
-        // a reconcile-only boot needs no transient.
-        declare,
-    };
-    if let Err(e) = coord.job_queue.submit(spec) {
+    // The sweep's own rebuild subgraphs emit their `Rebuilt` events as they
+    // land; the boot DAG as a whole has no terminal side effect, so no tail.
+    // The subgraphs also carry their own per-agent crash-watch suppression
+    // during their `Swap` (applied at claim time); a reconcile-only boot needs
+    // no transient.
+    if let Err(e) = coord.job_queue.submit(Source::AutoUpdate, reason, |b| {
+        boot_nodes(b, any_stale, fanout, drifted);
+    }) {
         tracing::warn!(error = ?e, "boot: sweep DAG submit failed");
     }
     coord.emit_rebuild_queue_snapshot();