job_queue: submit boot-time forge/matrix/webhook/knowledge sweeps as DAG nodes

hive-c0re/src/job_queue/model.rs

@@ -320,6 +320,31 @@ pub enum NodeKind {
     /// `Prebuild`, but that's a no-op there — the agent is down, so prebuild
     /// is skipped.)
     SetWanted { agent: String, up: bool },
+    /// One-shot boot-time forge user/token sweep for every existing
+    /// container (`forge::ensure_all`) — moved out of a bare `tokio::spawn`
+    /// so it shows as real work on the dashboard instead of running
+    /// invisibly until it fails. Agentless: it sweeps every container, not
+    /// one. Store/network-I/O only — build-slot- and lease-exempt, same
+    /// class as [`NodeKind::MetaSync`]/[`NodeKind::Provision`].
+    ForgeSweep,
+    /// One-shot boot-time matrix user/space sweep (`matrix::ensure_all`),
+    /// for the same dashboard-visibility reason as [`NodeKind::ForgeSweep`].
+    /// The *periodic* re-sweep (every 30 min, recovering token files
+    /// `hive-matrix-daemon` deleted) stays a background loop in
+    /// `main.rs` — only the boot-time instance is a DAG node.
+    MatrixSweep,
+    /// One-shot boot-time Forgejo webhook registration, for
+    /// `internal/knowledge` (push → git pull) and the `agent-configs` org
+    /// (`pull_request` → config-PR approval). No-op when the core token, hive
+    /// domain, or HMAC secret aren't available yet — mirrors the guard the
+    /// `tokio::spawn` block it replaced already used. Agentless, build-slot-
+    /// and lease-exempt.
+    WebhookRegister,
+    /// One-shot boot-time `/knowledge` pull (`knowledge::pull`), reconciling
+    /// any commits that landed while `hive-c0re` was down. Same rationale as
+    /// [`NodeKind::MatrixSweep`]: the periodic hourly re-pull stays a
+    /// background loop, only the boot-time instance is a DAG node.
+    KnowledgePull,
 }
 
 /// How a hive-c0re node describes itself to a generic graph viewer.
@@ -395,6 +420,10 @@ impl NodeKind {
             NodeKind::ResolveApproval { .. } => "resolve_approval",
             NodeKind::EmitRebuilt { .. } => "emit_rebuilt",
             NodeKind::SetWanted { .. } => "set_wanted",
+            NodeKind::ForgeSweep => "forge_sweep",
+            NodeKind::MatrixSweep => "matrix_sweep",
+            NodeKind::WebhookRegister => "webhook_register",
+            NodeKind::KnowledgePull => "knowledge_pull",
         }
     }
 
@@ -434,7 +463,11 @@ impl NodeKind {
             | NodeKind::SetWanted { agent, .. } => agent,
             NodeKind::MetaLock { .. }
             | NodeKind::Reparent { .. }
-            | NodeKind::ResolveApproval { .. } => "",
+            | NodeKind::ResolveApproval { .. }
+            | NodeKind::ForgeSweep
+            | NodeKind::MatrixSweep
+            | NodeKind::WebhookRegister
+            | NodeKind::KnowledgePull => "",
         }
     }