Make pending assignments safe to race, settle them on a tick, and say only what was checked

Review of #150: a withdrawal could land between the look and the act, a
failed ask read as a build in flight, a request kept the wrong asker, a
build being registered read as not built, build "true" could ask a build
nothing waited on, and a status read changed state. Claim a row under the
machine's hold before making it, keep a request only once asked, settle on
the controller's own tick, raise an assignment not made as a condition
until it is answered, and tie each row to its machine.

internal/inventory/pending_test.go

@@ -0,0 +1,25 @@
+package inventory
+
+import (
+	"testing"
+	"time"
+)
+
+// A pending assignment goes with its machine (novox/hq issue 325, review of mesh-controller#150 point 7).
+func TestAPendingAssignmentGoesWithItsMachine(t *testing.T) {
+	inv := ForTest(t)
+	ctx := t.Context()
+	if _, err := inv.AddNode(ctx, "leaving"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.RecordPending(ctx, PendingAssignment{Node: "leaving", Module: "sensors", Build: "b-1"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.store.Pool().Exec(ctx, `delete from node where name = 'leaving'`); err != nil {
+		t.Fatalf("a machine with a pending assignment could not be removed: %v", err)
+	}
+	rows, err := inv.Pending(ctx, time.Unix(0, 0))
+	if err != nil || len(rows) != 0 {
+		t.Fatalf("a pending assignment outlived its machine: %+v %v", rows, err)
+	}
+}