Build for the merge from a copy its tests never touch, and keep or take only the same head's build

The gate and the repository's check mount the workspace read-write, so a
build from that tree could hold what the tests wrote under a key that
describes the merge. A check now clones the merge outside the workspace
before anything of the change runs, and builds from that. A check keeps,
and a walk takes, only a build an earlier check of the same pull request
at the same head made: another pull request's build, or an earlier
head's, is never registered. The walk reads the verdicts once
(novox/hq issue 703, review of #328).

internal/builder/builder.go

@@ -162,6 +162,10 @@ type Reuse struct {
 	// keyFirst is a check's build (§1): its key is taken before anything is built, and a module with none is not
 	// built at all — nothing could ever take it.
 	keyFirst bool
+	// pull and head are the check's own pull request and the head it judged (novox/hq issue 703): it keeps only a
+	// build an earlier check of the same pull request at the same head made.
+	pull PullRef
+	head string
 }
 
 // errNoKey is a check's build of a module whose source does not pin it: not built (ADR 0350 §1).
@@ -498,11 +502,22 @@ func takeACheckBuild(ctx context.Context, run Runner, publish Publisher, reuse R
 }
 
 // keptCheckBuild is the build a check keeps instead of building (novox/hq issue 703): the one kept under the
-// module's key, when a verdict of the build seat names its key and every digest — the record alone is never trusted
-// (ADR 0350 §2) — and it holds every artifact the module declares. Nil, and the check builds, otherwise.
+// module's key by an earlier check of the same pull request at the same head — only the trunk moved — when a verdict
+// of the build seat names its key and every digest — the record alone is never trusted (ADR 0350 §2) — and it holds
+// every artifact the module declares. Another pull request's build, or an earlier head's, is never kept. Nil, and
+// the check builds, otherwise.
 func keptCheckBuild(ctx context.Context, reuse Reuse, module, key string, artifacts int,
 	say func(step, format string, args ...any)) *Reused {
-	if reuse.Scratch == nil || len(reuse.Named) == 0 {
+	if reuse.Scratch == nil || reuse.head == "" {
+		return nil
+	}
+	var same []NamedBuild
+	for _, n := range reuse.Named {
+		if n.Pull == reuse.pull {
+			same = append(same, n)
+		}
+	}
+	if len(same) == 0 {
 		return nil
 	}
 	found, ok, err := reuse.Scratch.Find(ctx, module, key)
@@ -512,7 +527,11 @@ func keptCheckBuild(ctx context.Context, reuse Reuse, module, key string, artifa
 		return nil
 	case !ok:
 		return nil
-	case unnamed(reuse.Named, module, key, found) != "":
+	case found.Pull != reuse.pull || found.Head == "" || twelve(found.Head) != twelve(reuse.head):
+		say("reuse", "the build kept under %s is %s, not this pull request's at this head: built", twelve(key[3:]),
+			found.Said())
+		return nil
+	case unnamed(same, module, key, found) != "":
 		say("reuse", "a build is kept under %s and no verdict names it with its digests: built", twelve(key[3:]))
 		return nil
 	case len(found.Made) != artifacts: