job_queue: hang the approval link off the deploy root

Non-derivable per-node payload rides the node that owns it. Tagging all
four deploy nodes with the approval id would render the same card four
times in `dag_view`.

Also fix `set_queue_step`'s doc comment, which claimed the DAG-id lookup
was exact because approval DAGs are single-node. They are not anymore;
what actually holds is that the chain is strictly sequential with the
root parked in Finishing, so at most one node is ever Running.

hive-c0re/src/coordinator.rs

@@ -668,12 +668,14 @@ impl Coordinator {
 
     /// Update the `step` label on the currently-running node of DAG
     /// `id` and (if it actually changed) re-emit the queue snapshot so
-    /// the dashboard renders the new phase. DAG-id-only surface for
-    /// the opaque approval pipeline in `actions.rs`, whose callbacks
-    /// don't know node ids (its DAGs are single-node, so the lookup is
-    /// exact); queue executors use the precise per-node sink in
-    /// `job_queue::exec` instead. No-op when `id` is `None` (callers
-    /// not running from the queue) or when nothing is `Running`.
+    /// the dashboard renders the new phase. DAG-id-only surface for the
+    /// approval-deploy bodies in `actions.rs`, which don't know their node id.
+    /// The lookup is still exact for them: a deploy DAG is a strictly
+    /// sequential chain whose resource-holding root sits in `Finishing` while
+    /// the phases run, so at most one node is ever `Running`. Queue executors
+    /// that do know their node id use the precise per-node sink in
+    /// `job_queue::exec` instead. No-op when `id` is `None` (callers not
+    /// running from the queue) or when nothing is `Running`.
     pub fn set_queue_step(self: &Arc<Self>, id: Option<u64>, step: &str) {
         let Some(id) = id else { return };
         if self.job_queue.set_step_running(id, step) {