Make a queue move lossless and run its passes on the acting controller alone (hq issue 558)

Review of #276: a move deleted before it published, so a failed publish
lost an ask; a verb's own process ran a pass beside the serving one, so
one could resume the queue while the other moved asks and a build ran
twice. The copy is now published first and second copies removed by id,
asks only signal the acting controller's loop, moves stop with 5 s of
the pause left, a cancel finds a moved ask by id, and an unreadable ask
keeps its age.

internal/link/queue.go

@@ -62,7 +62,7 @@ type QueuedAsk struct {
 	Path       string    `json:"path,omitempty"`
 	Ref        string    `json:"ref,omitempty"`
 	AskedAt    time.Time `json:"asked-at,omitempty"`
-	// Stored is when the stream took it: when it was asked, or last moved into order (novox/hq issue 558).
+	// Stored is when the stream first took it, a move into order kept (novox/hq issue 558).
 	Stored time.Time `json:"stored,omitempty"`
 	State  string    `json:"state"`
 	// On and Started are the holder building an in-flight ask and when it started, from its started
@@ -266,6 +266,10 @@ func ReadQueue(ctx context.Context, js *broker.JetStream, seat string) (Queue, e
 // askOf is one ask as the stream holds it: what its request says, and when the stream took it.
 func askOf(msg *jetstream.RawStreamMsg) QueuedAsk {
 	ask := QueuedAsk{Seq: msg.Sequence, Stored: msg.Time}
+	// Moved into order, it keeps when the stream first took it (novox/hq issue 558).
+	if at, err := time.Parse(time.RFC3339Nano, msg.Header.Get(QueuedAtHeader)); err == nil {
+		ask.Stored = at
+	}
 	if json.Unmarshal(msg.Data, &ask.Request) == nil {
 		r := ask.Request
 		ask.ID, ask.Repository, ask.Path, ask.Ref = r.ID, r.Repository, r.Path, r.Ref