lab: one job at a time with no await between check and start, and no rebuild left holding anything (issue 698, review 256)

A run and a rebuild each asked the package registry between checking for
the other and writing their status, so both could start and a bed could
raise machines from an image being replaced. The registry is asked first
now. A hard-killed rebuild's credential is cleaned like a run's; a job that
never recorded its process is lost rather than blocking every run; and
lab_check reports a missing or unreadable base image.

modules/lab/tsconfig.json

@@ -8,5 +8,5 @@
     "skipLibCheck": true,
     "noEmit": true
   },
-  "include": ["tools/index.ts", "tools/runs.ts", "tools/base.ts"]
+  "include": ["tools/index.ts", "tools/runs.ts"]
 }