Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

With a gate on the first machine and a rollback after it, a module's build rolls out by
default. The ones kept back say why: the network path a rollback could not cross, the
providers every consumer on a machine drops with, and the stores holding the photos.
A merge's deleted files are announced, so a module whose manifest went is forgotten
rather than asked to build (the public-acme plan failure).

modules/mssql/module.json

@@ -1,6 +1,10 @@
 {
   "module": "mssql",
   "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "a provider whose restart drops every consumer on its machine, and whose new version may upgrade its databases in place: a person takes each build, after a backup (hq ADR 0236)"
+  },
   "provides": [
     {
       "name": "mssql-database",