Keep judge builds warm in the build agent's judge cache, and leave nothing on the host

Review of #329: a judge's home made with a temporary directory inside the build
agent is resolved on the host by the container runtime, leaving a cold cache
behind on every check, and a kept judge was lost on every redeploy. Judge builds
now use the judge cache the build agent declares (MESH_JUDGE_CACHE), mounted into
judge builds only: one warm Go cache, the kept judges, and a fresh home per check
removed after it (hq ADR 0358 §6, issue 704, issue 482).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/mesh-builder/main.go

@@ -24,7 +24,6 @@ import (
 	"net/url"
 	"os"
 	"os/signal"
-	"path/filepath"
 	"sort"
 	"strings"
 	"syscall"
@@ -314,9 +313,9 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 			registry = r.Address
 		}
 		spec := checkSpecOf(request)
-		// A release branch's judge is kept beside the workspace, never in it: the check's containers mount the
-		// workspace, and a pull request's script must not plant the judge of the next check (novox/hq ADR 0358 §2).
-		spec.JudgeCache = judgeCacheOf(workspace)
+		// The judge cache the build agent declares as its own data, never in the workspace: only judge builds mount
+		// it, so no pull request's script can write what a judge is built with or kept as (novox/hq ADR 0358 §6).
+		spec.JudgeCache = judgeCache()
 		// What the merge would move, built by the check for the walk to take (novox/hq ADR 0350 §1): into the
 		// scratch namespace. **Never with the package registry's credential**: this is code nobody has approved
 		// yet, and a recipe could read the credential it is handed (issue 462). A module that resolves packages
@@ -476,11 +475,10 @@ func checkSpecOf(request link.BuildRequest) builder.CheckSpec {
 	return spec
 }
 
-// judgeCacheOf is where a release branch's judge is kept (novox/hq ADR 0358 §2): beside the workspace, outside what
-// a check's containers mount.
-func judgeCacheOf(workspace string) string {
-	return filepath.Clean(workspace) + "-judges"
-}
+// judgeCache is the judge cache the build agent's manifest declares (MESH_JUDGE_CACHE, novox/hq ADR 0358 §6): a
+// directory mounted at the same path on the host, so a judge build's mounts name what the agent sees. Empty when the
+// agent declares none, and every judge is then built cold under its check's root.
+func judgeCache() string { return os.Getenv("MESH_JUDGE_CACHE") }
 
 // triedOf is a try's outcome as its log line says it (novox/hq issue 686): the repository's own check's verdict,
 // or the check's where that did not run — a head that does not merge — and the lines naming what failed.

cmd/mesh-builder/release_test.go

@@ -1,8 +1,6 @@
 package main
 
 import (
-	"path/filepath"
-	"strings"
 	"testing"
 
 	"github.com/novox/mesh-controller/internal/link"
@@ -10,7 +8,7 @@ import (
 
 // **A pull request into a release branch reaches the check as one** (novox/hq ADR 0358): the build seat hands the
 // check the release branch and, beside it, the trunk each repository is read at when it has no branch of that name;
-// and it keeps the release branch's judge outside the workspace a check's containers mount.
+// and it hands the check the judge cache the build agent declares (MESH_JUDGE_CACHE), never a path of its own.
 func TestTheBuildSeatHandsTheCheckItsReleaseBranch(t *testing.T) {
 	spec := checkSpecOf(link.BuildRequest{ID: "b", Repository: "r", Ref: "abc", Check: &link.CheckRequest{
 		Owner: "novox", Repo: "mesh-catalog", Base: "feat/57", Release: "feat/57",
@@ -18,9 +16,12 @@ func TestTheBuildSeatHandsTheCheckItsReleaseBranch(t *testing.T) {
 	if spec.Release != "feat/57" || spec.Beside["mesh-host"].Ref != "feat/57" || spec.Beside["mesh-host"].Else != "main" {
 		t.Fatalf("the check was handed release %q and mesh-host %+v", spec.Release, spec.Beside["mesh-host"])
 	}
-	workspace := filepath.Join(t.TempDir(), "mesh-builder")
-	cache := judgeCacheOf(workspace)
-	if rel, err := filepath.Rel(workspace, cache); err != nil || !strings.HasPrefix(rel, "..") {
-		t.Fatalf("the judge cache %s lies inside the workspace %s, which a check's containers mount", cache, workspace)
+	t.Setenv("MESH_JUDGE_CACHE", "/var/lib/mesh/build-agent/judge-cache")
+	if got := judgeCache(); got != "/var/lib/mesh/build-agent/judge-cache" {
+		t.Fatalf("the judge cache the manifest declares is read as %q", got)
+	}
+	t.Setenv("MESH_JUDGE_CACHE", "")
+	if got := judgeCache(); got != "" {
+		t.Fatalf("with no judge cache declared, %q is used", got)
 	}
 }