jobq: a transient is any running node naming the agent

Per mara on #2822: status is the only test. The agent comes off the
node's own payload rather than a declared Resource::Agent edge, so the
lease-exempt kinds (Prebuild, MetaSync) that name an agent without
holding its lease now light a pill — they are work on that agent.

Dropping that test breaks the one-pill-per-agent invariant, since
lease-exemption is exactly what lets one DAG build for an agent while
another holds its lease. Everything keyed by agent alone had to follow:

- reconcile_transients keys (agent, label) via TransientSeen, so a
  second pill cannot evict the first — and cannot lose its
  takes_container_down, which the crash watcher reads at clear time.
- transient_snapshot returns a Vec per agent for the same reason. The
  collapse was silent: a Prebuild could evict a StopForUpdate and its
  deliberate_stop, making an intentional stop report as a crash.
- crash_watch asks whether ANY running node expects the container down.
- the dashboard renders one row per node instead of one per agent.

takes_container_down never reached the frontend; no wire change needed.

315 tests pass unchanged.

hive-c0re/src/dashboard/tombstones.rs

@@ -35,7 +35,7 @@ pub struct TombstoneView {
 pub(super) fn build_tombstone_views(
     coord: &Coordinator,
     containers: &[ContainerView],
-    transient_snapshot: &std::collections::HashMap<String, crate::coordinator::TransientState>,
+    transient_snapshot: &std::collections::HashMap<String, Vec<crate::coordinator::TransientState>>,
 ) -> Vec<TombstoneView> {
     let _ = coord; // kept_state_names is a free fn but takes &self by future plan
     let live: std::collections::HashSet<&str> = containers