c0re: history retention is a policy, split from the graph it reads

`visible_dags` mixed two things: walking the graph to classify containers
live-vs-terminal, and the sort-and-truncate that decides what the
dashboard sees. `retain_history` is the second half, generic over the
handle so it is reachable without a graph at all — a `NodeId` cannot be
fabricated, so a test forced to pass real ones could only get them by
submitting and running DAGs.

Which is exactly what the old test did: `MAX_HISTORY_DAGS + 8` submits,
claim and fail each node, read the ids back out of a snapshot — the
scheduler, the roll-up and the wire projection all standing in the path of
a policy that reads none of them. And it only ever exercised the tiebreak,
because every DAG in that loop settled inside the same wall-clock second,
so `finished_at` tied on all of them. Eviction *by time* — the actual
policy — had no coverage. It does now, along with the live-never-competes
case.

`live_count` and `templates::reconcile_only` were both test-only and lose
their last caller here.

hive-c0re/src/job_queue/templates.rs

@@ -405,29 +405,6 @@ pub fn approval_deploy(
     }
 }
 
-/// A single `Reconcile` node that converges observed power state to the
-/// persisted intent — `wanted` is untouched (no `SetWanted`), unlike the
-/// operator `start`/`stop` templates. Test-only helper now (used to build
-/// single-node lifecycle DAGs that exercise per-agent lease serialization
-/// in the queue tests); production paths no longer emit a bare reconcile.
-#[cfg(test)]
-pub fn reconcile_only(
-    agent: &str,
-    source: Source,
-    reason: String,
-) -> DagSpec<impl FnOnce(&Job) + use<>> {
-    let agent = agent.to_owned();
-    DagSpec {
-        source,
-        reason,
-        declare: Box::new(move |b: &Job| {
-            // Name the lease before the agent string is moved into the kind.
-            let lease = Resource::Agent(agent.clone());
-            let _reconcile = b.node(NodeKind::Reconcile { agent }).needs(lease);
-        }),
-    }
-}
-
 /// First-deploy spawn (approval-driven): `Provision` (proposed/applied
 /// repos, state subvolume, meta registration) then `Create`
 /// (`nixos-container create`), drop-in write, then `Reconcile` starts