Build for the merge from a copy its tests never touch, and keep or take only the same head's build

The gate and the repository's check mount the workspace read-write, so a
build from that tree could hold what the tests wrote under a key that
describes the merge. A check now clones the merge outside the workspace
before anything of the change runs, and builds from that. A check keeps,
and a walk takes, only a build an earlier check of the same pull request
at the same head made: another pull request's build, or an earlier
head's, is never registered. The walk reads the verdicts once
(novox/hq issue 703, review of #328).

cmd/mesh-controller/checks.go

@@ -283,30 +283,32 @@ func checkRequestFor(ctx context.Context, open *stores, p link.PullUpdated, scop
 		Source:     sourceOnSeat(source),
 		Check: &link.CheckRequest{Owner: p.Owner, Repo: p.Repo, Number: p.Number, Base: p.Base,
 			Paths: p.Paths, Beside: beside, Modules: scope.Modules, Dependents: scope.Dependents, New: scope.New,
-			Manifests: scope.Manifests, Judge: scope.Judge, Builds: builds, Named: namedForTheCheck(ctx, builds)},
+			Manifests: scope.Manifests, Judge: scope.Judge, Builds: builds, Named: namedForTheCheck(ctx, p, builds)},
 	}, nil
 }
 
-// namedForTheCheck are the builds the seat's verdicts name for the modules a check builds, read once for the check
-// (novox/hq issue 703): what it may keep instead of building again. None when they cannot be read, and the check
-// builds, as before.
-func namedForTheCheck(ctx context.Context, builds []link.CheckBuild) []link.CheckedBuild {
-	var modules []string
-	for _, b := range builds {
-		if b.Skip == "" {
-			modules = append(modules, b.Module)
-		}
-	}
-	if len(modules) == 0 {
+// namedForTheCheck are the builds earlier checks of the same pull request at the same head named, read once for the
+// check (novox/hq issue 703): asked again because only the trunk moved, the check keeps what they built of a key
+// still the same. Another pull request's build, or one of an earlier head, is never kept. None when they cannot be
+// read, and the check builds, as before.
+func namedForTheCheck(ctx context.Context, p link.PullUpdated, builds []link.CheckBuild) []link.CheckedBuild {
+	if len(builds) == 0 || p.Commit == "" {
 		return nil
 	}
-	named, err := checkedBuildsOfModules(ctx, modules)
+	pull := link.PullRef{Owner: p.Owner, Repo: p.Repo, Number: p.Number}
+	read, err := checkedBuildsOf(ctx, []link.PullRef{pull})
 	if err != nil {
-		fmt.Printf("  the checks' builds of %d module(s) could not be read, so the check builds them: %v\n",
-			len(modules), err)
+		fmt.Printf("  the earlier checks' builds of %s/%s#%d could not be read, so the check builds: %v\n",
+			p.Owner, p.Repo, p.Number, err)
 		// empty-on-error: said above; a check handed no named build builds every module, as before issue 703
 		return nil
 	}
+	var named []link.CheckedBuild
+	for _, b := range read {
+		if b.Pull == pull && link.SameHead(b.Head, p.Commit) {
+			named = append(named, b)
+		}
+	}
 	return named
 }