HostIdentity moves to the leaf product.host_identity (stacked on #13175)

[gunbai-bot]

HostIdentity moves to the leaf product.host_identity

Tracked follow-up from #13175. Its trigger was #13145 (the wave-1C cut) merging. Stacked on #13175 (base branch session/bright-hawk-257-host-identity); retarget to main once #13175 lands.

type HostIdentity (a branded NonEmptyStr) and host_identity_eq were declared in product.placement_supply. That module also imports extdeps.dhcp.v4 { MacAddress }, which reaches extdeps.dns.domain_name. So every module that only names a host (gunbc.fleet_host_identity, gunbc.fleet_posix_accounts, gunbc.fleet_lifecycle_observation, among others) imported DHCP and DNS.

• The type and its equality, with its note, move verbatim (no copy, no alias) to product.host_identity, which imports only std.types. product.placement_supply imports both back for its own rows. The two sibling notes (physical_asset_identity_eq, site_identity_eq) now cite the new home.
• Every import product.placement_supply { … } naming either symbol is split mechanically; any other names stay (323 modules import the leaf). One DeclarationRef (gunbc.doc_graph_roots) is repointed.

Effect on the broker closure: none yet (192 → 192), and the 189 I predicted on #13175 was wrong. That figure assumed #13145 would remove the broker's only route to product.placement_supply. It doesn't: gunbc.auth.approval_broker_serve itself imports extdeps.tailscale.serve { ServeStatusUnreadable }, and extdeps.tailscale.serve → product.network_topology → product.placement_supply (network_topology legitimately uses PhysicalAssetIdentity). After this PR that is the only route, so cutting the broker's direct tailscale.serve edge would drop placement_supply, dhcp.v4 and dns.domain_name from the broker closure. That edge is a separate question, raised with gentle-dove-36 rather than folded in here.

Evidence (local, gunbc rebuilt at this head):

• gunbc compile --target rust on the broker entry: 0 blocking, 199 files emitted (the whole closure resolves).
• product.placement_supply resolves.
• test.claim.fleet.fleet_intent_network_witness_test fails resolve with effect summary incomplete … product.network_topology.network_reachability … names no registry row, identically on main e624825 and at Fleet host identities move to the leaf gunbc.fleet_host_identity (broker closure 196 → 192) #13175's head. It is not from this PR.

🤖 Generated with Claude Code

[briansrls]

LAND on the rebuilt head. HostIdentity and host_identity_eq move as one authority to the leaf product.host_identity; product.placement_supply consumes them rather than retaining an alias, and the importer/DeclarationRef edits are mechanical. The generated-lane repair adds the one missed gunbc.generated_artifact importer and does not change the model. Exact-head CI has restarted and is still queued, so this approval records code readiness, not permission to bypass the required run.