job_queue: hang the approval link off the deploy root

Non-derivable per-node payload rides the node that owns it. Tagging all
four deploy nodes with the approval id would render the same card four
times in `dag_view`.

Also fix `set_queue_step`'s doc comment, which claimed the DAG-id lookup
was exact because approval DAGs are single-node. They are not anymore;
what actually holds is that the chain is strictly sequential with the
root parked in Finishing, so at most one node is ever Running.

hive-c0re/src/job_queue/mod.rs

@@ -789,8 +789,11 @@ impl QueueInner {
                     Dep::Resource { .. } => None,
                 })
                 .collect();
-            // Non-derivable per-node payload rides the node that owns it.
-            let approval_id = matches!(node.payload, NodeKind::ApprovalDeploy { .. })
+            // Non-derivable per-node payload rides the node that owns it. For a
+            // deploy that's the subtree root: the phases below it are ordinary
+            // nodes, and hanging the approval link off all four would render the
+            // same card four times.
+            let approval_id = matches!(node.payload, NodeKind::DeployWindow { .. })
                 .then_some(meta.approval_id)
                 .flatten();
             let inputs = if matches!(node.payload, NodeKind::MetaLock { .. }) {