Keep a facts snapshot for merge checks, and say when it goes stale (hq to-be 45 Phase 5, S14)

Every check the mesh had was right about the world it was given and none was given
the mesh's: a real machine's name made an identity too long (263), the node-engine
refused what the catalogue check passed (236). The controller now composes what a
check needs - every machine under a pseudonym of its name's length, its roles,
system, builds, capabilities, assignments, pins, settings and how its declaration
composes; every seat, module and source; the bus, store and node-engine versions it
runs - with no secret, no address and no name, and keeps it in the artifact store
as facts:latest when it moved, or daily. The replaced snapshot's manifest is let go
of, so the nightly collector takes it. S14 raises facts-stale past two days.

cmd/mesh-controller/main.go

@@ -114,6 +114,9 @@ func run() error {
 		return brokerCommand(ctx, args[1:])
 	case "serve":
 		return serve(ctx)
+	// The facts snapshot a merge check is fed (novox/hq to-be 45 §9).
+	case "facts":
+		return factsCommand(ctx, args[1:])
 	case "upgrade":
 		return upgradeCommand(ctx, args[1:])
 	// The bus as a planned step (novox/hq to-be 45 §8, ADR 0236).