wip(#3001): convert tests off the container id; drop Source + insert_group

The last of the DAG-container removal. `tests.rs` navigated by the id
`submit` returned, so removing the container removed the tests' way of
finding what they inserted; they name the roots they assert on now, which
is the same handle production uses.

Three findings the port surfaced, each a behaviour change rather than a
test fix:

- Cancelling a rebuild's head no longer drops the job. `Reconcile`'s edge
  accepts a skipped brace, and a cancel-cascade skips rather than cancels,
  so the tail stays claimable. Dropping a job means cancelling every id the
  insert returned.
- A directly-cancelled group root reads terminal while a spared tail still
  runs; the cancel used to land on a node above it, which rolled up
  Finishing instead.
- "One DAG per hive-wide op" is not expressible without a container. The
  three tests asserting it now assert that every named root is top-level,
  which is what makes the per-agent subgraphs concurrent.

Deletes two tests: one asserted only that two containers get distinct ids,
the other re-ran an existing case under a second name.

`Source`, `insert_group` and the stop path's `reason` string went dead with
the container and are removed with it.

hive-host-sock/src/jobs.rs

@@ -1,6 +1,11 @@
-//! Vocabulary hive-c0re's job queue shares with its clients: where a job
-//! came from ([`Source`]), what a permission change carries
-//! ([`PermPayload`]), and the scheduler's lifecycle [`State`].
+//! Vocabulary hive-c0re's job queue shares with its clients: what a
+//! permission change carries ([`PermPayload`]) and the scheduler's
+//! lifecycle [`State`].
+//!
+//! A `Source` enum lived here too — where a job came from, rendered as the
+//! "why" chip. It was a field on the DAG container, and it went with it: a
+//! job is its nodes now, and a node says what it does rather than who asked
+//! for it.
 //!
 //! **The typed `DagView`/`NodeView` projection that used to live here is
 //! gone.** One graph is served one way now — `hive_jobq_wire`'s generic
@@ -12,37 +17,6 @@
 
 use serde::{Deserialize, Serialize};
 
-/// Where the submit request originated — drives the "why" chip on the
-/// dashboard.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "snake_case")]
-pub enum Source {
-    /// Operator action (dashboard button, CLI, manager tool).
-    Manual,
-    /// Meta-update cascade rebuild (grown into the meta-update DAG).
-    MetaUpdate,
-    /// Boot-time submission (the boot sweep DAG + boot reconciles).
-    AutoUpdate,
-    /// Crash recovery path (future use).
-    CrashRecover,
-    /// Operator approved a pending `Approval` row; `approval_id` on
-    /// the DAG points back at the source row.
-    Approval,
-}
-
-impl Source {
-    #[must_use]
-    pub fn as_str(self) -> &'static str {
-        match self {
-            Source::Manual => "manual",
-            Source::MetaUpdate => "meta_update",
-            Source::AutoUpdate => "auto_update",
-            Source::CrashRecover => "crash_recover",
-            Source::Approval => "approval",
-        }
-    }
-}
-
 pub use hive_jobq::State;
 
 /// Kind-specific payload for `Template::PermChange` DAGs.