Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

With a gate on the first machine and a rollback after it, a module's build rolls out by
default. The ones kept back say why: the network path a rollback could not cross, the
providers every consumer on a machine drops with, and the stores holding the photos.
A merge's deleted files are announced, so a module whose manifest went is forgotten
rather than asked to build (the public-acme plan failure).

modules/nats/module.json

@@ -1,6 +1,10 @@
 {
   "module": "nats",
   "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the bus: replaced only as a planned step a person starts (`bus upgrade`), its streams snapshotted first and checked after (hq ADR 0236); the controller holds this whatever is said here"
+  },
   "provides": [
     {
       "name": "mesh-bus",