The mesh's own roles carry a protocol, and the build branch retires

ADR 0121, first half. The `mesh-*` seats said who does a job and nothing about what
may be said to them or by them, so the mesh had roles it could not describe. They
take the same three fields a module's seat has now, and the machinery that already
derives a work queue, a holder's worker and a permission set from a declared seat
does it for these too.

The build-machine role accepts a build and emits an outcome, so `mesh.build.request`,
`mesh.control.built` and the BUILDS stream are gone. A work queue shared by several
build machines is what a seat's `accepts` already is, and keeping a second mechanism
for it was two places a permission could be wrong.

The controller's own side of a seat is a named list rather than something derived: it
is not a module and declares no `uses`, so which roles the mesh itself submits work to
has to be stated — and stating it makes that question answerable.

Two things this caught:

**The followed event subjects were hard-coded and had just gone stale.** They were
written out while the catalogue still spelled its events as the old bus's routing keys,
so converting those (issue 127) turned the pair into a controller listening to a
subject nothing publishes — the same fault as the issue, from the other side. They
derive from the emitter and the event name now, through the same function the
permission uses, so the two cannot drift apart.

**A role's queue exists before its holder**, checked against a real server, and
asserting twice changes nothing. Work queues until somebody arrives to do it, so
assigning a build machine later flushes the backlog instead of having lost it.

internal/inventory/busrecords.go

@@ -38,6 +38,15 @@ func (i *Inventory) BusRecords(ctx context.Context) (broker.Records, error) {
 			seats[s.Name] = s
 		}
 	}
+	// And the mesh's own, which carry protocol too (novox/hq ADR 0121). Added after the modules'
+	// rather than before, because a `mesh-*` name is the mesh's and registration refuses a module
+	// declaring one — so this cannot be shadowed, and if it ever were, the mesh's own would win.
+	for _, own := range catalogue.SeatsWithAProtocol() {
+		seats[own.Name] = catalogue.SeatDeclaration{
+			Name: own.Name, Scope: own.Scope,
+			Accepts: own.Accepts, Emits: own.Emits, Serves: own.Serves,
+		}
+	}
 
 	out := broker.Records{Assigned: map[string][]broker.Declared{}, People: map[string][]string{}}
 	for _, n := range nodes {
@@ -88,9 +97,9 @@ func declaredFor(m catalogue.Manifest, seats map[string]catalogue.SeatDeclaratio
 		Serves: m.Tools,
 	}
 	for _, c := range m.Claims {
-		// A seat the mesh defines for itself carries no protocol, so holding one grants nothing here:
-		// those seats say who does a job, not who may say what.
-		if s, declaredSomewhere := seats[c.Name]; declaredSomewhere {
+		// Every seat with a protocol, the mesh's own included. One that says only who does a job is
+		// not here and grants nothing, which is most of them.
+		if s, hasAProtocol := seats[c.Name]; hasAProtocol {
 			d.Holds = append(d.Holds, asSeat(s))
 		}
 	}
@@ -106,6 +115,18 @@ func asSeat(s catalogue.SeatDeclaration) broker.Seat {
 	return broker.Seat{Name: s.Name, Accepts: s.Accepts, Emits: s.Emits, Serves: s.Serves}
 }
 
+// MeshSeats are the mesh's own seats that carry a protocol, as the bus needs them: what to make a work
+// queue for, and whose holder gets a worker on it (novox/hq ADR 0121).
+func MeshSeats() []broker.DeclaredSeat {
+	var out []broker.DeclaredSeat
+	for _, s := range catalogue.SeatsWithAProtocol() {
+		out = append(out, broker.DeclaredSeat{
+			Name: s.Name, Accepts: s.Accepts, Emits: s.Emits, Serves: s.Serves,
+		})
+	}
+	return out
+}
+
 // NodesWithALiveToken is every machine holding a token that could still be presented — issued, not
 // expired, not redeemed.
 //