Keep a named push from sending builds a policy or a plan holds back

A named push flushed every other machine whose declaration differed from
what it was last sent (hq ADR 0083). Under an upgrade policy of `record`,
or a plan still waiting on its first machine (ADR 0218), every machine
running the module differs, so `push <one>` sent the held build to all of
them (hq issue 259).

Each send now records which build of each module it carried
(node.sent_builds, migration 0061). The cascade, and the bus holder added
to a named push, skip a machine any of whose modules would move to a
build its policy records or an open plan has not sent it, and say which
module, which build, why, and that `push <node>` sends it. A machine
whose last send was not recorded is held until it is named. The named
machine itself, a whole-mesh push and `push --behind` are unchanged.

internal/inventory/doing_test.go

@@ -189,7 +189,7 @@ func TestAMachineIsWaitingWhenWhatItWasSentIsNotWhatItShouldBe(t *testing.T) {
 	}
 
 	// Sent what it should be: not waiting.
-	if err := inv.RecordSent(ctx, anchor.ID, "aaa"); err != nil {
+	if err := inv.RecordSent(ctx, anchor.ID, "aaa", nil); err != nil {
 		t.Fatal(err)
 	}
 	waiting, err = inv.Waiting(ctx, map[string]string{"anchor": "aaa", "laptop": "bbb"})
@@ -234,7 +234,7 @@ func TestAMachineWithNothingComputedForItIsNotWaiting(t *testing.T) {
 	// It has been sent something before, which is what makes this the case the guard is for: a
 	// machine with a digest and nothing computed for it would compare against the empty string
 	// and look out of date, when the truth is that nobody worked out what it should be.
-	if err := inv.RecordSent(ctx, node.ID, "what-it-got-last-time"); err != nil {
+	if err := inv.RecordSent(ctx, node.ID, "what-it-got-last-time", nil); err != nil {
 		t.Fatal(err)
 	}
 	waiting, err := inv.Waiting(ctx, map[string]string{})