wip(#3001): convert tests off the container id; drop Source + insert_group

The last of the DAG-container removal. `tests.rs` navigated by the id
`submit` returned, so removing the container removed the tests' way of
finding what they inserted; they name the roots they assert on now, which
is the same handle production uses.

Three findings the port surfaced, each a behaviour change rather than a
test fix:

- Cancelling a rebuild's head no longer drops the job. `Reconcile`'s edge
  accepts a skipped brace, and a cancel-cascade skips rather than cancels,
  so the tail stays claimable. Dropping a job means cancelling every id the
  insert returned.
- A directly-cancelled group root reads terminal while a spared tail still
  runs; the cancel used to land on a node above it, which rolled up
  Finishing instead.
- "One DAG per hive-wide op" is not expressible without a container. The
  three tests asserting it now assert that every named root is top-level,
  which is what makes the per-agent subgraphs concurrent.

Deletes two tests: one asserted only that two containers get distinct ids,
the other re-ran an existing case under a second name.

`Source`, `insert_group` and the stop path's `reason` string went dead with
the container and are removed with it.

hive-c0re/src/job_queue/mod.rs

@@ -45,7 +45,7 @@ use hive_jobq_wire::{GraphNode, GraphWire};
 use tokio::sync::Notify;
 
 pub use hive_jobq::TerminalState;
-pub use model::{NodeKind, PermPayload, Source, State};
+pub use model::{NodeKind, PermPayload, State};
 use resource::Resource;
 
 /// A job under construction: `hive_jobq`'s builder over this queue's payload
@@ -137,35 +137,12 @@ fn outcome_of(result: Result<(), String>) -> Outcome {
     }
 }
 
-/// Insert a declared `job` into the shared graph, returning the inserted ids.
-///
-/// A node that declared no parent hangs under `group_parent` — the DAG
-/// container for a template, the emitting node for a runtime-appended
-/// subgraph. Templates declare the parent axis + sibling ordering directly, so
-/// there is no dep-on-root to drop and no lease to hoist: each node declares
-/// its own resources, and the crate's borrow model keeps a resource continuous
-/// across a subtree (a root owns it, descendants borrow it). Independent group
-/// roots carry no cross-links, so a multi-agent DAG's per-agent subgraphs run
-/// concurrently, each on its own lease.
-///
-/// # Errors
-/// Propagates a crate graph-insert error (malformed dep/parent / dep-scope).
-fn insert_group(
-    inner: &mut Sched,
-    declare: impl FnOnce(&JobBuilder),
-    group_parent: Option<NodeId>,
-) -> anyhow::Result<()> {
-    inner
-        .insert_job(group_parent, |b| {
-            declare(b);
-            // A runtime-appended subgraph is addressed by the node that emitted
-            // it (`group_parent`), so this path names nothing. Callers that DO
-            // want a handle use `JobQueue::insert` and name the node there.
-            Vec::new()
-        })
-        .map_err(|e| anyhow::anyhow!("job_queue: graph insert failed: {e}"))?;
-    Ok(())
-}
+// `insert_group` lived here: a `group_parent`-taking insert whose only
+// remaining caller was the DAG container, everything under it. Runtime growth
+// never went through it — an executor declares into the builder `hive_jobq`
+// hands it, which parents the new work under the emitting node by
+// construction. With no container to be the other kind of parent, the
+// distinction it existed to express is gone.
 
 impl JobQueue {
     #[must_use]