A build machine gets its own credential, scoped to build work

The builder was documented as holding its own broker credential and
nothing else, and nothing issued one — so in practice it used whatever it
was handed, which was the broker's administrative account. A program
documented as holding its own credential and given somebody else's is
worse than one with no story at all.

`builder issue <name>` creates an account that may read the build queue
and write to the mesh exchange. Not a node account: a build machine is
not a node, and a node's queue carries its declarations.

Two faults found by running it, both about the answer path:

- the reply queue was left for the broker to name, and the account was
  scoped to `amq.gen-*` — one broker's convention. The builder built,
  could not answer, and the connection closed. Reply queues are named
  here now, deterministically.
- the answer then went via the DEFAULT exchange, where permission is
  granted per exchange rather than per queue. A builder allowed to use it
  could publish into any node's queue, which is the privilege a build
  machine most obviously should not have. Answers go through the mesh
  exchange, which it already may use, and an asker binds its reply queue
  to the same key and filters by correlation.

Verified against a real broker: a builder cannot consume a node's queue
and cannot publish to the default exchange. That check nearly reported
the opposite — an unconfirmed publish is asynchronous, so the refusal
arrives as a channel close afterwards and a naive test sees success. With
publisher confirms it is immediate. A negative security assertion made
against an asynchronous call is not an assertion.

Redelivery was observed working while fixing this: builders that died
before answering left their work on the queue, and the next builder did
all of it.

Also: the queue and exchange names exist in both `broker` and `link`,
because `link` imports `broker`. A test in an external package keeps them
agreeing — a builder scoped to a queue nothing publishes to takes no work
and says nothing about why.

internal/broker/management.go

@@ -62,6 +62,11 @@ func QueueFor(node string) string { return "node." + node }
 // the traffic between them).
 const ExchangeName = "mesh"
 
+// BuildQueueName is where build work waits. Duplicated from `link` rather than imported, for the
+// same reason QueueFor above is: this package must not depend on the one that uses it, and a
+// constant that differed would be caught by the test that asserts they agree.
+const BuildQueueName = "builds"
+
 // CreateNodeAccount gives a node its own broker account, with the token's secret as the password.
 //
 // Scoped so a node can reach its own queue and the one exchange, and nothing else. The patterns
@@ -89,6 +94,47 @@ func (m *Management) CreateNodeAccount(ctx context.Context, node, password strin
 	return nil
 }
 
+// CreateBuilderAccount scopes an account to taking build work and answering it.
+//
+// **A build machine is not a node**, and giving it a node's account would let it read another
+// machine's declarations. What it needs is narrower and different: read the build queue, and
+// write to the exchange and to whatever temporary queue an asker is waiting on.
+//
+// The reply queues are the reason `write` is not simply the exchange. `RequestBuild` declares an
+// exclusive queue with a generated name and waits on it, so a builder that could not write to it
+// could take work and never answer — which is the failure that looks like a builder that is not
+// running.
+func (m *Management) CreateBuilderAccount(ctx context.Context, name, password string) error {
+	if !safeName.MatchString(name) {
+		return fmt.Errorf(
+			"%q cannot be a broker account name: it becomes part of a permission pattern, so it "+
+				"is lower-case letters, digits and dashes", name)
+	}
+
+	if err := m.put(ctx, "/api/users/"+url.PathEscape(name),
+		map[string]string{"password": password, "tags": ""}); err != nil {
+		return fmt.Errorf("cannot create the broker account for %s: %w", name, err)
+	}
+
+	builds := regexp.QuoteMeta(BuildQueueName)
+	if err := m.put(ctx, "/api/permissions/%2f/"+url.PathEscape(name), map[string]string{
+		// It declares the build queue, because whichever builder starts first must be able to —
+		// and a queue nobody may declare is a queue that exists only if the control plane has
+		// already run, which makes the order they start in matter.
+		"configure": "^" + builds + "$",
+		// The exchange, and nothing else. **Not the default exchange**: permission there is
+		// granted per exchange rather than per queue, so a builder allowed to use it could
+		// publish into any node's queue — the privilege a build machine most obviously should
+		// not have. Answers go through the exchange, which is why they can.
+		"write": "^" + regexp.QuoteMeta(ExchangeName) + "$",
+		// The build queue and nothing else. Not another machine's declarations.
+		"read": "^" + builds + "$",
+	}); err != nil {
+		return fmt.Errorf("cannot scope the broker account for %s: %w", name, err)
+	}
+	return nil
+}
+
 // RemoveNodeAccount withdraws a node's access.
 func (m *Management) RemoveNodeAccount(ctx context.Context, node string) error {
 	if !safeName.MatchString(node) {