Keep judge builds warm in the build agent's judge cache, and leave nothing on the host

Review of #329: a judge's home made with a temporary directory inside the build
agent is resolved on the host by the container runtime, leaving a cold cache
behind on every check, and a kept judge was lost on every redeploy. Judge builds
now use the judge cache the build agent declares (MESH_JUDGE_CACHE), mounted into
judge builds only: one warm Go cache, the kept judges, and a fresh home per check
removed after it (hq ADR 0358 §6, issue 704, issue 482).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/mesh-builder/main.go

@@ -24,7 +24,6 @@ import (
 	"net/url"
 	"os"
 	"os/signal"
-	"path/filepath"
 	"sort"
 	"strings"
 	"syscall"
@@ -314,9 +313,9 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 			registry = r.Address
 		}
 		spec := checkSpecOf(request)
-		// A release branch's judge is kept beside the workspace, never in it: the check's containers mount the
-		// workspace, and a pull request's script must not plant the judge of the next check (novox/hq ADR 0358 §2).
-		spec.JudgeCache = judgeCacheOf(workspace)
+		// The judge cache the build agent declares as its own data, never in the workspace: only judge builds mount
+		// it, so no pull request's script can write what a judge is built with or kept as (novox/hq ADR 0358 §6).
+		spec.JudgeCache = judgeCache()
 		// What the merge would move, built by the check for the walk to take (novox/hq ADR 0350 §1): into the
 		// scratch namespace. **Never with the package registry's credential**: this is code nobody has approved
 		// yet, and a recipe could read the credential it is handed (issue 462). A module that resolves packages
@@ -476,11 +475,10 @@ func checkSpecOf(request link.BuildRequest) builder.CheckSpec {
 	return spec
 }
 
-// judgeCacheOf is where a release branch's judge is kept (novox/hq ADR 0358 §2): beside the workspace, outside what
-// a check's containers mount.
-func judgeCacheOf(workspace string) string {
-	return filepath.Clean(workspace) + "-judges"
-}
+// judgeCache is the judge cache the build agent's manifest declares (MESH_JUDGE_CACHE, novox/hq ADR 0358 §6): a
+// directory mounted at the same path on the host, so a judge build's mounts name what the agent sees. Empty when the
+// agent declares none, and every judge is then built cold under its check's root.
+func judgeCache() string { return os.Getenv("MESH_JUDGE_CACHE") }
 
 // triedOf is a try's outcome as its log line says it (novox/hq issue 686): the repository's own check's verdict,
 // or the check's where that did not run — a head that does not merge — and the lines naming what failed.