No build reaches a machine without a gate; a release plan walks what waits (hq ADR 0236)

A send carries the machine's whole declaration, so at the switch to roll the next send of
anything would have carried the old default's backlog, unjudged, to every machine. A gated
send now carries and judges everything waiting on its machine; every other send is refused
or leaves the machine; a release plan walks what waits one machine at a time, the control
node last, and one that fails holds the next until a person releases it.

internal/inventory/migrations/0073-a-build-rolls-out-gated-and-rolls-back.sql

@@ -65,3 +65,8 @@ create table bus_step (
     outcome      text        not null default '' check (outcome in ('', 'done', 'failed')),
     found        text        not null default ''
 );
+
+-- 4. A release plan (ADR 0236): the builds that wait for a gate — the backlog the old default left, and
+--    whatever a plan built and did not send — walked through the machines one at a time, each judged
+--    before the next. Its walk is kept with the plan.
+alter table release_plan add column release jsonb;