Say which modules wait for a person's push, and announce the files a merge deleted (hq ADR 0236)

With a gate on the first machine and a rollback after it, a module's build rolls out by
default. The ones kept back say why: the network path a rollback could not cross, the
providers every consumer on a machine drops with, and the stores holding the photos.
A merge's deleted files are announced, so a module whose manifest went is forgotten
rather than asked to build (the public-acme plan failure).

modules/sshd/module.json

@@ -1,6 +1,10 @@
 {
   "module": "sshd",
   "version": "1",
+  "upgrade": {
+    "policy": "record",
+    "why": "the operator's way into the machine when the mesh cannot reach it: a build that breaks it is found only when that way is needed, which no gate sees (hq ADR 0236)"
+  },
   "capabilities": [
     "package-manager",
     "service-manager"