Keep what each machine says of what it runs, raise it, and gate on it (hq ADR 0240, to-be 48 Phase A)

The gate judged a module by what the mesh saw from outside, so a container that
crash-looped after it applied passed it. Each machine's node-engine now states
the health of every long-running resource it runs; the controller keeps the
newest statement per machine, raises module.<module>.<machine>.unhealthy on the
second statement in a row, clears it on the first that does not say it, and the
gate passes a module only when every long-running resource of it is stated
healthy since the send. An engine that states nothing is judged as before.

internal/link/bus.go

@@ -75,8 +75,16 @@ const (
 	// ToolsAliveSubjects is every machine's node tools saying they are there (novox/hq to-be 45 §3,
 	// S11): core NATS like the host's, for the same reason.
 	ToolsAliveSubjects = "mesh.control.*.tools-alive"
+
+	// HealthSubjects is every machine's health statement between its reports (novox/hq ADR 0240): core
+	// NATS like the heartbeat, because a statement lost is said again within a minute while anything is
+	// not healthy, and the next report carries it whatever happens.
+	HealthSubjects = "mesh.control.*.health"
 )
 
+// HealthSubject is one machine's health statement.
+func HealthSubject(node string) string { return "mesh.control." + node + ".health" }
+
 // ReportSubject is where one node says what it did. On the CONTROL stream, because it is the
 // message the store-window guarantee is about (ADR 0083).
 func ReportSubject(node string) string { return "mesh.control." + node + ".report" }