Build for the merge from a copy its tests never touch, and keep or take only the same head's build

The gate and the repository's check mount the workspace read-write, so a
build from that tree could hold what the tests wrote under a key that
describes the merge. A check now clones the merge outside the workspace
before anything of the change runs, and builds from that. A check keeps,
and a walk takes, only a build an earlier check of the same pull request
at the same head made: another pull request's build, or an earlier
head's, is never registered. The walk reads the verdicts once
(novox/hq issue 703, review of #328).

internal/builder/reuse_test.go

@@ -630,13 +630,19 @@ func TestABuildTwoChecksShareGoesWithTheLastOfThem(t *testing.T) {
 // aCheckAgain is a later check (build-2) of aPull building the module from a tree, with the builds the build seat's
 // verdicts name for it (novox/hq issue 703).
 func aCheckAgain(t *testing.T, scratch *aScratch, tree string, leave []NamedBuild) (CheckBuilt, *recorded) {
+	t.Helper()
+	return aCheckOf(t, scratch, aPull, "abcdefabcdef", tree, leave)
+}
+
+// aCheckOf is a later check (build-2) of a pull request at a head, the trunk moved since build-1.
+func aCheckOf(t *testing.T, scratch *aScratch, pull PullRef, head, tree string, leave []NamedBuild) (CheckBuilt, *recorded) {
 	t.Helper()
 	r, run, workspace := aModuleAt(t, tree)
-	spec := CheckSpec{ID: "build-2", Owner: aPull.Owner, Repo: aPull.Repo, Number: aPull.Number,
+	spec := CheckSpec{ID: "build-2", Owner: pull.Owner, Repo: pull.Repo, Number: pull.Number,
 		Builds: []CheckBuildSpec{{Module: "meshboard", Repository: "https://forge.invalid/meshboard.git", Path: "mod",
 			Ref: "main"}}}
 	built := buildForTheMerge(t.Context(), run, spec, CheckBuilding{Publish: r, Scratch: scratch, Named: leave},
-		workspace, "", "", CheckVerdict{Head: "fedcbafedcba", Trunk: "654321654321"}, GitCredential{}, nil, logging(nil))
+		workspace, "", "", CheckVerdict{Head: head, Trunk: "654321654321"}, GitCredential{}, nil, logging(nil))
 	if len(built) != 1 || built[0].NotBuilt != "" || built[0].Key == "" {
 		t.Fatalf("the second check did not answer the module for its merge: %+v", built)
 	}
@@ -745,3 +751,28 @@ func TestABuildALaterCheckKeptStaysWhenTheCheckThatBuiltItGoes(t *testing.T) {
 		t.Fatalf("the build stayed after the last check naming it went: held %v, record %v", held(), found())
 	}
 }
+
+// Only an earlier check of the same pull request at the same head is kept from: another head of it, or another pull
+// request whose verdict names the same key and digests, builds (novox/hq issue 703).
+func TestACheckKeepsNoBuildOfAnotherHeadOrPullRequest(t *testing.T) {
+	withVersion(t, "builder-1")
+	other := PullRef{Owner: "novox", Repo: "meshboard", Number: 8}
+	for name, c := range map[string]struct {
+		pull PullRef
+		head string
+	}{
+		"another head":         {aPull, "999999999999"},
+		"another pull request": {other, "abcdefabcdef"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			scratch := newScratch()
+			first := aCheckBuilt(t, scratch, "tree-one")
+			leave := named(first)
+			leave[0].Pull = c.pull // as if its own verdict named it
+			again, r := aCheckOf(t, scratch, c.pull, c.head, "tree-one", leave)
+			if !dockerBuilt(r) || again.Kept != "" {
+				t.Fatalf("a build of %s was kept: %+v", name, again)
+			}
+		})
+	}
+}