feat(#2772): make a dependency edge a set of accepted outcomes

`DepWhen` was two named cases, so every new combination wanted a new
variant. It is now a set over the terminal outcomes: a `u8` bitset
newtype, no dependency, with `AFTER_OK` / `AFTER_ANY` kept as the two
constants the templates actually use. "Run regardless" is all outcomes,
"anything that isn't a failure" is `{Done, Cancelled}`, a compensation
branch is `{Failed}` — closed under combination, so it never needs
another variant.

`TerminalState` is its own type rather than a subset of `State`, so an
edge cannot name `Pending` / `Running` / `Finishing`. Those are
meaningless in a dependency and are better unrepresentable than
validated against. The empty set is the one thing that can't be typed
away — nothing satisfies it, so `validate` rejects it next to the cycle
check.

Two consequences worth calling out:

- `cascade_cancel` collapses to one rule: a pending node is doomed once
  any edge it names can no longer be satisfied. The hardcoded `AfterOk`
  special case is gone, and a weak-edged node survives its dependency's
  cancellation because of its own edge rather than by exemption.
- The cascade now runs on **any** terminal outcome, `Done` included.
  With sets, success rules dependents out just as failure does — a
  `{Failed}` branch is unsatisfiable the moment its dependency succeeds,
  and leaving it `Pending` would wedge the subtree non-terminal forever.
  That is a hang, not a wrong answer, so it is the load-bearing half of
  this commit.

Edges are conjunctive, so "any of these N failed" is not directly
sayable. The composition that works is in the tests: the success branch
depends `AFTER_OK` on every root, so it is itself cancelled the moment
one of them doesn't succeed, and the failure branch hangs off *that*
with `{Cancelled}`. Exactly one of the two runs.

Also deletes hive-c0re's duplicate `DepWhen` enum and the
`to_crate_when` translation beside it. The copy bought nothing and had
to be widened in lockstep with the crate's edge model — it is the
in-between layer #2772 exists to remove, and it is what broke the build
when the crate's spelling changed.

All 34 jobq tests pass, including the four new ones covering both
directions of a failure-only branch, weak-edge survival of a cancelled
dependency, and the aggregator composition.

hive-c0re/src/job_queue/mod.rs

@@ -44,12 +44,12 @@ use chrono::{DateTime, Utc};
 use hive_host_sock::jobs::NodeView;
 use hive_jobq::resources::ResourceTable;
 use hive_jobq::scheduler::{Outcome, Scheduler};
-use hive_jobq::{Dep, DepWhen as JobDepWhen, Graph, NodeId, State as JobState};
+use hive_jobq::{Dep, Graph, NodeId, State as JobState};
 use hive_sh4re::wire_time::now_unix;
 use tokio::sync::Notify;
 
 use crate::coordinator::TransientKind;
-pub use model::{DagSpec, DagView, DepWhen, NodeKind, NodeSpec, PermPayload, Source, State};
+pub use model::{DagSpec, DagView, NodeKind, NodeSpec, PermPayload, Source, State};
 use resource::Resource;
 
 /// How many terminal DAGs (`Done` / `Failed` / `Cancelled`) the snapshot
@@ -190,14 +190,6 @@ impl Default for JobQueue {
     }
 }
 
-/// Map a spec dependency edge kind onto the crate's.
-fn to_crate_when(when: DepWhen) -> JobDepWhen {
-    match when {
-        DepWhen::AfterOk => JobDepWhen::AfterOk,
-        DepWhen::AfterAny => JobDepWhen::AfterAny,
-    }
-}
-
 /// Map a crate node state onto the wire state (`Pending` ↔ `Queued`;
 /// `Finishing` — own logic done, sub-nodes still running — reads as `Running`).
 fn to_wire_state(state: JobState) -> State {
@@ -241,7 +233,7 @@ fn insert_group(
         for d in &ns.deps {
             deps.push(Dep::Node {
                 id: ids[dep_index(d.on)],
-                when: to_crate_when(d.when),
+                when: d.when,
             });
         }
         let parent = match ns.parent {