Act under a lease, keep accounts by order, one writer at composition (hq to-be 45 Phase 2)

Two controllers could both act (issue 204), a reconcile's report could
overtake the apply after it and the digest decided (issue 267), and a grant
could make a second writer of a machine's report.

- The lease (internal/lease, ADR 0229): mesh-controller_lease key `holder`,
  15 s age, renewed every 5 s by compare-and-set; the epoch is the revision
  it was taken at. The gate is the clock (stops 3 s before expiry); a refused
  renewal is a loss and the process exits; a holder that stops gives it back.
  serve takes it before asserting the bus. Epochs kept in the store
  (migration 0068 controller_epoch) as a floor: a bucket raised from nothing
  is compacted past it. Unleased (no epoch, S12 urgent) only when nobody
  holds it and the bus will not let it be written. A shell command acts
  under the holder's epoch, or its own lease when none.
- Declarations carry `epoch` inside the signed envelope, only to a machine
  whose latest account carried a report_sequence (mesh-host #35); would-send
  is composed with the epoch last sent. Allot and the send both pass the gate.
- Reports: contract in internal/link/order.go (epoch, sequence,
  report_sequence, older_than, refused_older). Accounts kept by epoch, then
  sequence, then report sequence; older refused, counted; unordered reports
  keep the digest rule. Plans by compare-and-set on a revision, with epoch.
  Conditions and calls carry the epoch and are not written off the lease.
- S12 and S13 (naming the writer by epoch) watched, D5 run; reset of the
  bucket said. Writers table compiled in and enforced in PermissionsFor; the
  controller no longer publishes mesh.control.>. A contract per consumed
  kind, and the empty-on-error lint over the repository.
- mesh-host pinned to its main with the epoch in the validator (D1 validates
  the envelope as sent).

Needs mesh-host's genesis lock with the lease grant (mesh-host PR) for
TestTheInstallersFirstUserListIsWhatTheControllerWouldCompose.

cmd/mesh-controller/release_plan.go

@@ -441,7 +441,7 @@ func planBuilt(ctx context.Context, open *stores, module, commit, failed string,
 			state.BuiltAt = &now
 			state.Commit = commit
 		}
-		if err := inv.SavePlan(ctx, *p); err != nil {
+		if err := inv.SavePlan(ctx, p); err != nil {
 			fmt.Printf("%s: cannot keep the plan: %v\n", p.ID, err)
 			continue
 		}
@@ -500,7 +500,7 @@ func advanceHeld(ctx context.Context, open *stores) {
 				// Kept in the plan, so `plans` says why it has not moved rather than the log alone;
 				// the state is left as it was and the step is tried again on the next tick.
 				p.Note = "tier " + fmt.Sprint(p.Tier) + ": " + err.Error() + " — tried again"
-				if err := inv.SavePlan(ctx, *p); err != nil {
+				if err := inv.SavePlan(ctx, p); err != nil {
 					fmt.Printf("%s: cannot keep the plan: %v\n", p.ID, err)
 				}
 				break
@@ -508,7 +508,7 @@ func advanceHeld(ctx context.Context, open *stores) {
 			if p.State == inventory.PlanFailed {
 				sayUnsent(p, rollsOut)
 			}
-			if err := inv.SavePlan(ctx, *p); err != nil {
+			if err := inv.SavePlan(ctx, p); err != nil {
 				fmt.Printf("%s: cannot keep the plan: %v\n", p.ID, err)
 				break
 			}
@@ -1076,7 +1076,7 @@ func plansCommand(ctx context.Context, args []string) error {
 			u, err := inv.UpgradeOf(ctx, m)
 			return err == nil && u.RollOut
 		})
-		if err := inv.SavePlan(ctx, p); err != nil {
+		if err := inv.SavePlan(ctx, &p); err != nil {
 			return err
 		}
 		fmt.Printf("%s %s at tier %d of %d; what was asked still builds and registers, nothing further is asked\n",