docs(#3034): move the brace rationale out of templates.rs into coordinator.md

The pre-push comment-block lint rejected two 40-line doc blocks, correctly: the
module doc and `rebuild_subtree`'s now carry the trigger and a pointer, and the
reasoning lives in a new `#### Braces` section.

That move surfaced a third doc the resource change had falsified. The scheduler's
lease-acquirer list still named `StopForUpdate` / `Swap` / `Signal` / `Drain`,
all of which are now exempt. The list now separates container-affecting nodes
from braces, and says why the rebuild subtree's members are exempt for a
different reason than `MetaSync` / `Prebuild`: they do touch the container, but
their brace holds the lease above them.

docs/coordinator.md

@@ -190,17 +190,56 @@ resources are free. Resources:
    held by nix-heavy nodes for the node's duration.
 2. **Per-agent lifecycle lease** — keyed on the **node's** agent (agent is
    per-node; a DAG can span agents) and globally exclusive per agent across
-   all DAGs: acquired at a container-affecting node (`SetWanted`,
-   `StopForUpdate`, `Swap`, `Signal`, `Drain`, `Reconcile`, `WriteDropin`,
-   `Create`, `DeployWindow`), held by the owning DAG until it's terminal,
-   so two DAGs never interleave container ops on the same agent. A DAG
-   touching several agents holds one lease per agent. (`SetWanted` is a store
-   write, not a container op, but takes the lease anyway so a power-op DAG's
-   intent write + reconcile is atomic — two racing ops can't clobber intent
-   before either reconciles.) **Lease-exempt**: `MetaSync`, `Prebuild`,
-   `MetaLock`, `WritePermFile`, `Reparent` —
-   they touch the store / meta, not the running container, which is exactly
-   why a stop can land while another DAG's prebuild is still building.
+   all DAGs: acquired either at a container-affecting node (`SetWanted`,
+   `Reconcile`, `WriteDropin`, `Create`) or at a **brace** (`AgentWindow`,
+   `DeployWindow`) on behalf of a whole coordinated subtree; held by the owning
+   DAG until it's terminal, so two DAGs never interleave container ops on the
+   same agent. A DAG touching several agents holds one lease per agent.
+   (`SetWanted` is a store write, not a container op, but takes the lease anyway
+   so a power-op DAG's intent write + reconcile is atomic — two racing ops can't
+   clobber intent before either reconciles.) **Lease-exempt**: `MetaSync`,
+   `Prebuild`, `MetaLock`, `WritePermFile`, `Reparent` — they touch the store /
+   meta, not the running container, which is exactly why a stop can land while
+   another DAG's prebuild is still building. Also exempt, for a different
+   reason, are the rebuild subtree's own members (`StopForUpdate`, `Swap`,
+   `Signal`, `Drain`, `RebuildBookkeeping`): they genuinely do touch the
+   container, but their `AgentWindow` brace holds the lease above them — see
+   _Braces_ below.
+
+#### Braces
+
+Templates otherwise declare a resource on **every** node that needs it, even
+when a parent already holds it, so the requirement belongs to the node rather
+than to one DAG shape it happens to appear in. A **brace** is the one sanctioned
+exception: a pure-resource-holder root that declares on behalf of a subtree
+coordinated with itself, whose members then declare nothing.
+
+It is forced rather than stylistic. Declaring a resource means *"I need this
+exclusively"*, and the agent lease is single-unit — so **two siblings that both
+declared it could never run concurrently.** For a subtree whose whole point is
+concurrency (`Prebuild` beside the `Signal` → `Drain` quiesce window), declaring
+the requirement truthfully on every node and running those nodes in parallel are
+mutually exclusive. One holder above them speaks for the subtree.
+
+This is the opposite of the failure the declare-your-own rule exists to prevent,
+not a relapse into it: there the requirement was *implicit*, inferred from a
+node's kind and true only by accident of placement. Here it is explicit, on one
+node, with the omission below it documented on the brace itself.
+
+Two consequences worth knowing:
+
+- **Flattening a chain under a brace is safe.** The stop chain used to nest
+  `Signal` over `Drain` over `StopForUpdate` specifically so the lease stayed
+  continuous — as independent siblings each would acquire it separately and
+  leave a gap another DAG could claim the agent in, mid-bounce. A brace supplies
+  that continuity directly, so the nesting is no longer load-bearing.
+- **Observability is unaffected.** `running_transients` keys off a node's
+  *payload* agent, not off a declared lease edge, so every child still lights its
+  own dashboard pill and still reports its own `takes_container_down` to the
+  crash watcher. A brace itself reports `false`: it parents the stopping nodes
+  but does not stop anything, and claiming otherwise would widen crash
+  suppression across the build and tail, where a vanished container is still a
+  real crash.
 
 Among simultaneously-ready nodes competing for a resource, DAG-submit order
 wins (FIFO) so bulk operations drain predictably. The scheduler also owns the