c0re: serve the jobq graph generically at /api/jobq/graph

`graph_node` projects a `hive_jobq::Node` onto the wire type from the
parent commit: everything the crate records, with hive-c0re's own fields
(`agent`, `approval_id`, `inputs`, `build_log_id`) collected into the
opaque payload slot instead of standing as named columns. A node with
nothing domain-specific to say serialises no `data` key at all, so the
slot costs nothing when it is unused.

`graph_dep` turns a `DepWhen` into the set of outcomes that satisfy the
edge by asking it about each of the four terminal states, rather than
leaking the bitflags representation onto the wire.

`Resource::wire_name` gives the resource vocabulary a string form —
hive-jobq is generic over the resource type, so a viewer that renders any
graph cannot be handed this enum. The `agent:` prefix keeps per-agent
leases from colliding with a global resource sharing an agent's name.

`graph_snapshot` deliberately reuses `visible_dags` for retention: every
live group plus the newest terminal ones. Serving the raw graph would
grow without bound — evicted groups' nodes linger until bounded pruning
lands. Within a retained group nothing is filtered: group roots ride as
ordinary nodes, and `Done` nodes stay, which is the projection defect
behind the "rebuild shows a single node" report.

The endpoint lands in the same commit rather than after it. Without a
consumer the whole projection is dead code, and a wire type nobody
produces cannot be reviewed for whether it says the right things.

Its OpenAPI body is `serde_json::Value`, matching `api_state`: no type in
`hive-host-sock` derives `ToSchema`, and that crate stays dependency-lean
on purpose.

hive-c0re/src/job_queue/resource.rs

@@ -57,3 +57,20 @@ pub enum Resource {
     /// held across the holder's whole subtree).
     MetaWindow,
 }
+
+impl Resource {
+    /// This resource's name on the generic graph wire.
+    ///
+    /// `hive_jobq` is generic over the resource type, so a viewer that can
+    /// render any graph gets a string here rather than this enum. The
+    /// `agent:` prefix keeps the per-agent leases from colliding with a
+    /// hypothetical global resource that happens to share an agent's name.
+    #[must_use]
+    pub fn wire_name(&self) -> String {
+        match self {
+            Resource::BuildSlot => "build-slot".to_owned(),
+            Resource::Agent(agent) => format!("agent:{agent}"),
+            Resource::MetaWindow => "meta-window".to_owned(),
+        }
+    }
+}