refactor(#2949): the build-log row carries its node id

`QueueInner` was `{ sched, node_rt }`, where `node_rt` held exactly one
datum per node: the `build_logs` row id. It existed because a `hive_jobq`
node payload is immutable after insert while the log row is created when
the build starts — so the link could not ride the node.

Invert it: the log row names its node (`build_logs.node_id`, one migration
in the existing `schema_versions` framework). Same single-home property,
in the direction the type system allows.

`QueueInner` is now just the scheduler. That is the point: the queue holds
no per-node side map, so nothing has to be locked alongside the graph.

Deleted as a consequence, each surfaced by dead-code analysis after the
edit above rather than predicted:

- `NodeRuntime`, `node_rt`, `set_build_log_id`, and `build_log_id_of`
  (which linear-scanned the map to match a wire `u64` against opaque
  `NodeId`s). The lookup is an indexed query now.
- `struct Ctx`, entirely. It carried `coord` + `dag_id` + `node_id` into
  the executors so the build-log callback could reach the queue; without
  the callback, `coord`/`dag_id` were never read and `node_id` was already
  on the `Claim` both executors receive.
- `QueueInner::node_running`, which existed only for `set_build_log_id`'s
  "only while running" guard.
- The `Fn(i64)` callbacks on `prebuild_toplevel` / `swap_update` /
  `priv_run_inner`, replaced by a `node_id: Option<u64>` passed down. The
  id travels one way now instead of being registered back.

`meta.rs`'s `nix_logged` passes `None` deliberately: its callers reach it
from outside the queue as well as inside, and nothing reads the link for
them yet.

`id_for_node` takes `MAX(id)` rather than assuming uniqueness — a retried
node opens a second row and the panel wants the current attempt. The test
moved to where the behaviour lives and covers that, plus survival across
completion and non-collision with node-less rows.

hive-c0re/src/lifecycle/mod.rs

@@ -274,10 +274,10 @@ pub async fn swap_update(
     name: &str,
     hive: &HiveEnv,
     paths: &AgentPaths,
-    on_build_log_id: &(dyn Fn(i64) + Send + Sync),
+    node_id: Option<u64>,
 ) -> Result<()> {
     write_dropins(name, hive, paths).await?;
-    priv_run_inner("update", name, Some(on_build_log_id)).await
+    priv_run_inner("update", name, node_id).await
 }
 
 /// Build the `AgentSpec` list for the meta flake from `nixos-container
@@ -582,14 +582,10 @@ pub async fn destroy(name: &str) -> Result<()> {
 /// the prebuild happens before stop, and `docs/coordinator.md::Prebuild
 /// attr path` for why the explicit nixosConfigurations attr is required.
 ///
-/// `on_build_log_id` fires with the `build_logs` row id as soon as the
-/// row opens, so queue-side callers can link their node to the live
-/// stream. Pass `&|_| ()` when not needed.
-pub async fn prebuild_toplevel(
-    name: &str,
-    flake_ref: &str,
-    on_build_log_id: &(dyn Fn(i64) + Send + Sync),
-) -> Result<()> {
+/// `node_id` is the queue node this build belongs to, when there is one —
+/// it is stored on the `build_logs` row so the dashboard can find the log
+/// from the node. Pass `None` for builds that run outside the queue.
+pub async fn prebuild_toplevel(name: &str, flake_ref: &str, node_id: Option<u64>) -> Result<()> {
     use tokio::io::{AsyncBufReadExt, BufReader};
     // Split `<root>#<name>` so we can re-emit with the explicit
     // `nixosConfigurations.<name>` segment. The flake_ref shape is
@@ -624,15 +620,12 @@ pub async fn prebuild_toplevel(
     // into the row; `finish` lands the terminal status before we bail.
     let logs = crate::build_logs::global();
     let log_id = logs.as_ref().and_then(|h| {
-        h.start(name, "prebuild", &cmdline)
+        h.start(name, "prebuild", &cmdline, node_id)
             .map_err(|e| {
                 tracing::warn!(error = ?e, "build_logs: start failed (prebuild log dropped)");
             })
             .ok()
     });
-    if let Some(id) = log_id {
-        on_build_log_id(id);
-    }
 
     let mut child = Command::new("nix")
         .args(&args)
@@ -784,37 +777,25 @@ async fn priv_run(kind: &str, name: &str) -> Result<()> {
     priv_run_inner(kind, name, None).await
 }
 
-/// Like `priv_run` but calls `on_log_id(log_id)` immediately after the
-/// build-log row is opened — before the actual container op starts.
-/// This lets callers surface the row id for live streaming (e.g. the
-/// rebuild-queue worker sets `build_log_id` on the queue entry so the
-/// dashboard can link to `/api/build-logs/id/{id}/stream`).
+/// Like `priv_run` but stamps `node_id` onto the build-log row it opens, so
+/// the dashboard can find the log from the queue node (and link to
+/// `/api/build-logs/id/{id}/stream`).
 ///
-/// The callback fires only when a build-log row is successfully opened
-/// (i.e. the global `BuildLogs` handle is installed AND `h.start()`
-/// succeeds). No-op when `on_log_id` is `None` — that's the path for
-/// all callers that don't need the id.
-async fn priv_run_inner(
-    kind: &str,
-    name: &str,
-    on_log_id: Option<&(dyn Fn(i64) + Send + Sync)>,
-) -> Result<()> {
+/// This used to be a `Fn(i64)` callback that handed the row id *back* to the
+/// queue, which then held it in a side map. The row carries the link itself
+/// now, so the id only ever travels one way.
+async fn priv_run_inner(kind: &str, name: &str, node_id: Option<u64>) -> Result<()> {
     let container = container_name(name);
     let cmdline = format!("nixos-container {kind} {container}");
 
     let logs = crate::build_logs::global();
     let log_id = logs.as_ref().and_then(|h| {
-        h.start(name, kind, &cmdline)
+        h.start(name, kind, &cmdline, node_id)
             .map_err(|e| {
                 tracing::warn!(error = ?e, "build_logs: start failed (priv_run log dropped)");
             })
             .ok()
     });
-    // Notify the caller as soon as the log row exists so it can surface
-    // the id for live streaming before the container op even starts.
-    if let (Some(id), Some(cb)) = (log_id, on_log_id) {
-        cb(id);
-    }
 
     // For long-running ops use the streaming protocol so build_logs
     // receives lines in real time rather than as a batch at completion.