refactor(#2756): replace the DAG terminal hook with real tail nodes

The queue carried a per-DAG `HookKind` that fired an inline side effect
from outside the graph when a container rolled up terminal. mara asked
three times why this could not be an ordinary node; the answer in the
code was a doc-comment claiming a node could not work, and it was wrong.

`DepWhen::AfterAny` already existed with two live users, and a weak edge
is satisfied by a `Cancelled` dep, so a tail node runs on success,
failure and cancel alike. What was genuinely missing was smaller than a
hook: a node had no way to learn how the work it followed ended.

So: `Claim` now carries `deps: Vec<DepOutcome>`, snapshotted at claim
time from the graph the scheduler already holds (no `hive-jobq` change).
`Claim::deps_state()` / `deps_error()` roll that up, and two new kinds
consume it — `ResolveApproval { approval_id }` and `EmitRebuilt { agent }`.
Templates append one as a group-root with `AfterAny` edges onto the DAG's
other group roots; a root's state is its subtree's roll-up, so that
covers every node without fanning out to each of them.

Deleted: `HookKind`, `DagSpec.hook`, `NodeKind::Dag.hook`, `DagMeta.hook`,
`TerminalDag`, `terminal_dag()`, `terminal_summary()`, `dag_agents()`,
`dag_rollup()`, `fire_terminal_hook()`, `run_terminal_hook()`,
`emit_rebuilt()`. `complete_node` returns `()`.

Load-bearing details:

- `JobQueue::cancel` spares tail nodes instead of cancelling the whole
  subtree, and returns `bool`. Without this a cancelled approval DAG
  would dangle its approval forever — the hazard `tests.rs` already
  named. The spared tail's deps are `Cancelled`, which satisfies its weak
  edge, so the scheduler claims it and it resolves the row as cancelled.
  `hive-jobq` anticipated exactly this: `cancel_node`'s doc already says
  to settle afterwards so "a weak-edge terminal node observing the
  cancellation" can advance.
- The existing `complete(container)` call after cancelling is kept and is
  deliberately a no-op when a tail was spared (a non-terminal child parks
  the container back in `Finishing`), so power ops still settle
  synchronously with no branch.
- `DeployTail` is NOT `is_tail()`: it does real compensating work, and a
  cancelled DAG has nothing to compensate.
- `exec::failure_reason` falls back to `first_error(dag_id)` because a
  group root that rolled up `Failed` from a child carries no error of its
  own — without it every tail-reported failure would lose its reason.
- `EmitRebuilt` is per agent, so a multi-agent DAG reports each agent's
  own outcome rather than painting all of them with the DAG roll-up.
- `ResolveApproval` is agentless: the approval row already names its
  agent, and that is also what lets one tail close a multi-agent DAG.

Transients-derived-from-running-nodes and the frontend's node-kind
strings stay out of this change; they touch iris's slice and review
better next to their own diff.

hive-c0re/src/job_queue/scheduler.rs

@@ -105,10 +105,9 @@ fn handle_completion(coord: &Arc<Coordinator>, done: NodeDone) {
                     .job_queue
                     .append_subgraph(claim.dag_id, subgraph, claim.node_id);
             }
-            let terminal = coord
+            coord
                 .job_queue
                 .complete_node(claim.dag_id, claim.node_id, Ok(()));
-            fire_terminal_hook(coord, terminal);
         }
         Err(e) => {
             let msg = format!("{e:#}");
@@ -120,10 +119,9 @@ fn handle_completion(coord: &Arc<Coordinator>, done: NodeDone) {
                 error = %msg,
                 "job_queue: node failed"
             );
-            let terminal = coord
+            coord
                 .job_queue
                 .complete_node(claim.dag_id, claim.node_id, Err(msg));
-            fire_terminal_hook(coord, terminal);
         }
     }
     // The next loop iteration re-reconciles the transient pills against the
@@ -131,19 +129,6 @@ fn handle_completion(coord: &Arc<Coordinator>, done: NodeDone) {
     coord.emit_rebuild_queue_snapshot();
 }
 
-/// Fire a settled DAG's inline terminal hook (approval-resolve / rebuilt-emit /
-/// intent-revert) off the container-terminal summary `complete_node` returned —
-/// spawned so the async hook doesn't block the scheduler loop.
-fn fire_terminal_hook(coord: &Arc<Coordinator>, terminal: Option<super::TerminalDag>) {
-    let Some(terminal) = terminal else {
-        return;
-    };
-    let coord = Arc::clone(coord);
-    tokio::spawn(async move {
-        exec::run_terminal_hook(&coord, &terminal).await;
-    });
-}
-
 /// Reconcile the transient-guard set against live lease ownership: drop pills
 /// whose lease is no longer held, create one for each newly-held `(dag, agent)`.
 fn reconcile_transients(