A build machine gets its own credential, scoped to build work

The builder was documented as holding its own broker credential and
nothing else, and nothing issued one — so in practice it used whatever it
was handed, which was the broker's administrative account. A program
documented as holding its own credential and given somebody else's is
worse than one with no story at all.

`builder issue <name>` creates an account that may read the build queue
and write to the mesh exchange. Not a node account: a build machine is
not a node, and a node's queue carries its declarations.

Two faults found by running it, both about the answer path:

- the reply queue was left for the broker to name, and the account was
  scoped to `amq.gen-*` — one broker's convention. The builder built,
  could not answer, and the connection closed. Reply queues are named
  here now, deterministically.
- the answer then went via the DEFAULT exchange, where permission is
  granted per exchange rather than per queue. A builder allowed to use it
  could publish into any node's queue, which is the privilege a build
  machine most obviously should not have. Answers go through the mesh
  exchange, which it already may use, and an asker binds its reply queue
  to the same key and filters by correlation.

Verified against a real broker: a builder cannot consume a node's queue
and cannot publish to the default exchange. That check nearly reported
the opposite — an unconfirmed publish is asynchronous, so the refusal
arrives as a channel close afterwards and a naive test sees success. With
publisher confirms it is immediate. A negative security assertion made
against an asynchronous call is not an assertion.

Redelivery was observed working while fixing this: builders that died
before answering left their work on the queue, and the next builder did
all of it.

Also: the queue and exchange names exist in both `broker` and `link`,
because `link` imports `broker`. A test in an external package keeps them
agreeing — a builder scoped to a queue nothing publishes to takes no work
and says nothing about why.

internal/link/build.go

@@ -30,6 +30,13 @@ const BuildQueue = "builds"
 // KeyBuilt is what a builder publishes when it has finished, successfully or not.
 const KeyBuilt = "built"
 
+// ReplyQueue is where the answer to one request goes.
+//
+// **Named here rather than left to the broker**, so it can be scoped and reasoned about. A broker
+// generates its own name for an unnamed queue, and a builder permitted to write to whatever that
+// convention happens to produce works on one broker and silently cannot answer on another.
+func ReplyQueue(id string) string { return BuildQueue + ".reply." + id }
+
 // BuildRequest is one module to build.
 type BuildRequest struct {
 	// ID correlates the answer with the asking. Not the module name: two builds of one module can
@@ -90,10 +97,23 @@ func RequestBuild(ctx context.Context, channel *amqp.Channel, request BuildReque
 	// Its own queue for the answer, declared before the ask. Consuming from the shared exchange
 	// would mean competing with the control plane's own consumer for a message meant for this
 	// caller — which is the fault this package's own doc comment records having had.
-	replies, err := channel.QueueDeclare("", false, true, true, false, nil)
+	replies, err := channel.QueueDeclare(ReplyQueue(request.ID), false, true, true, false, nil)
 	if err != nil {
 		return BuildResult{}, err
 	}
+	// Bound to the exchange, and the answer comes back through it.
+	//
+	// **A builder never publishes to the default exchange**, because permission there is per
+	// exchange and not per queue — a builder allowed to use it could publish into any node's
+	// queue, which is the privilege a build machine most obviously should not have. Found by
+	// running it: the builder built, could not answer, and the connection closed saying only
+	// "not allowed to publish to exchange ''".
+	//
+	// The cost is that every asker sees every result, which is why the correlation is checked
+	// below rather than assumed.
+	if err := channel.QueueBind(replies.Name, KeyBuilt, Exchange, false, nil); err != nil {
+		return BuildResult{}, err
+	}
 	answers, err := channel.ConsumeWithContext(ctx, replies.Name, "", true, true, false, false, nil)
 	if err != nil {
 		return BuildResult{}, err