Only a thing built and never run is unassignable

The check read "declares no resources" as "runs nowhere", and those are not
the same. The private network declares no resources either — the control plane
computes them when it composes a machine's declaration — and it is assigned to
every machine that has to reach another one. Refusing it stopped a four-machine
bed at its first assignment.

The signal is narrower: it builds an artifact and places nothing. Made a
function of its own, because a judgement with a wrong answer this expensive
should be testable without a database — nothing guarded it, which is how it
shipped.

internal/inventory/buildinput_test.go

@@ -0,0 +1,44 @@
+package inventory
+
+import (
+	"testing"
+
+	"github.com/novox/mesh-control/internal/catalogue"
+)
+
+// The image every module is compiled on top of is built and never run.
+func TestAThingBuiltAndNeverRunIsABuildInput(t *testing.T) {
+	m := catalogue.Manifest{
+		Module: "mesh-tools",
+		Build:  &catalogue.Build{Artifacts: []catalogue.Artifact{{Name: "runtime", Kind: "image"}}},
+	}
+	if !IsBuildInput(m) {
+		t.Fatal("a module that builds an artifact and places nothing is assignable, so `assign` " +
+			"succeeds and the machine is sent a declaration containing nothing of it")
+	}
+}
+
+// The private network declares no resources either, and is assigned to every machine that has to
+// reach another one.
+//
+// **This is the one that matters.** Reading "no resources" as "runs nowhere" refused it, and a
+// four-machine bed stopped dead at the first assignment — the control plane computes its resources
+// when it composes a declaration, so there is nothing in its manifest to see.
+func TestTheMeshsOwnNetworkIsNotABuildInput(t *testing.T) {
+	if IsBuildInput(catalogue.Manifest{Module: "networking"}) {
+		t.Fatal("the private network was refused as a thing that runs nowhere; nothing could " +
+			"then reach anything else")
+	}
+}
+
+// And an ordinary module that both builds and runs is assignable, which is most of them.
+func TestAModuleThatBuildsAndRunsIsAssignable(t *testing.T) {
+	m := catalogue.Manifest{
+		Module:    "postgres",
+		Build:     &catalogue.Build{Artifacts: []catalogue.Artifact{{Name: "runtime", Kind: "image"}}},
+		Resources: []map[string]any{{"id": "server", "type": "container"}},
+	}
+	if IsBuildInput(m) {
+		t.Fatal("a module that builds something and also runs it was refused")
+	}
+}