Merge the release fix/1921-zero-version-builds into the registry group: mesh-build-go keys a composer by the versions its compose ask names, in the group's typed fetch (issue 1921, issue 1966)

The release read the versions from the untyped fetch's packages argument; the group's ComposeJob carries them in
buildstep.Fetch.Packages, so the group's form stands, and the release's check that the key differs for named versions
joins the existing test.

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

modules/mesh-build-go/cmd/mesh-build-go/compose_test.go

@@ -99,7 +99,7 @@ func TestAKeptComposerIsRunWithTheManifestsFilled(t *testing.T) {
 }
 
 // 1921: the versions an ask names are an input of the composer it builds, so a composer kept for one set is not run for
-// another.
+// another; an ask naming none keeps the key it always had.
 func TestAComposerIsKeptPerAskedVersions(t *testing.T) {
 	m := composeModule(t)
 	m.ReadManifest, _ = indexerHolds(t)
@@ -107,6 +107,10 @@ func TestAComposerIsKeptPerAskedVersions(t *testing.T) {
 	tc := sdkstep.ToolchainUsed{Version: "go1.26.0", Recipe: m.Recipe.Version()}
 	plain := sdkstep.ComposerKey("novox/mesh-sdk", composeCommit, "go", composer.Package, tc, nil)
 	a.Compose.Fetch.Packages = sdkstep.PackageVersions{"git.novox.be/novox/mesh-sdk/go": strings.Repeat("3", 40)}
+	named := sdkstep.ComposerKey("novox/mesh-sdk", composeCommit, "go", composer.Package, tc, a.Compose.Fetch.Packages)
+	if plain == named {
+		t.Fatal("the key ignores the versions")
+	}
 	// A composer kept under the key without versions is not used for the ask that names some: it is fetched.
 	os.MkdirAll(filepath.Dir(m.composerPath(plain)), 0o700)
 	os.WriteFile(m.composerPath(plain), []byte("#!/bin/sh\nexit 0\n"), 0o700)