Build for the merge from a copy its tests never touch, and keep or take only the same head's build

The gate and the repository's check mount the workspace read-write, so a
build from that tree could hold what the tests wrote under a key that
describes the merge. A check now clones the merge outside the workspace
before anything of the change runs, and builds from that. A check keeps,
and a walk takes, only a build an earlier check of the same pull request
at the same head made: another pull request's build, or an earlier
head's, is never registered. The walk reads the verdicts once
(novox/hq issue 703, review of #328).

internal/builder/check_builds.go

@@ -37,9 +37,10 @@ type CheckBuilding struct {
 	Held    map[string]string
 	Npmrc   Npmrc
 	Seats   map[string]string
-	// Named are the builds the build seat's verdicts name for the modules this check builds, of any pull request,
-	// within the week check builds are kept (novox/hq issue 703): a build kept under a module's key is kept again,
-	// instead of built, only when one of them names its key and every digest. The record alone is never enough.
+	// Named are the builds the build seat's verdicts of earlier checks of this pull request at this head name
+	// (novox/hq issue 703): a build kept under a module's key is kept again, instead of built, only when one of them
+	// names its key and every digest, and the build is this pull request's at this head. The record alone is never
+	// enough.
 	Named []NamedBuild
 }
 
@@ -108,7 +109,8 @@ func buildForTheMerge(ctx context.Context, run Runner, spec CheckSpec, with Chec
 		var mirrored []string
 		result, err := build(ctx, run, scratchPublisher{to: with.Publish}, repository, b.Path, at,
 			filepath.Join(workspace, "for-the-merge"), held, with.Npmrc, forge, log, &mirrored,
-			&Reuse{keyFirst: true, Scratch: with.Scratch, Named: with.Named}, with.Seats)
+			&Reuse{keyFirst: true, Scratch: with.Scratch, Named: with.Named,
+				pull: PullRef{Owner: spec.Owner, Repo: spec.Repo, Number: spec.Number}, head: judged.Head}, with.Seats)
 		built := CheckBuilt{Module: b.Module, Key: result.ReuseKey, Took: time.Since(began)}
 		switch {
 		case errors.Is(err, errNoKey):