Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

With a gate on the first machine and a rollback after it, a module's build rolls out by
default. The ones kept back say why: the network path a rollback could not cross, the
providers every consumer on a machine drops with, and the stores holding the photos.
A merge's deleted files are announced, so a module whose manifest went is forgotten
rather than asked to build (the public-acme plan failure).

modules/dnsmasq/module.json

@@ -1,6 +1,10 @@
 {
   "module": "dnsmasq",
   "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the mesh's resolver: a build that breaks it can stop a machine resolving the bus, and then neither the gate's rollback nor a push reaches it (hq ADR 0236, issue 260)"
+  },
   "provides": [
     {
       "name": "wildcard-resolution",