Keep the builds of the grants step's machine alone, not of every machine its composition resolves (repo-check of #230)

Composing the bus's machine resolves the others on the same context, and
a machine never recorded as sent refused the whole composition.

cmd/mesh-controller/release.go

@@ -257,7 +257,7 @@ func ungatedIn(ctx context.Context, open *stores, names []string, addedHolder st
 		// The grants step composes every module at the build its machine was last sent (novox/hq issue 490):
 		// a move it keeps is not made. Read, not assumed, so a move it could not keep is still refused here.
 		var keeps map[string]string
-		if everyBuildKept(ctx) {
+		if everyBuildKept(ctx, n) {
 			if keeps, err = recordedKept(ctx, open, n); err != nil {
 				return nil, err
 			}
@@ -968,7 +968,7 @@ func grantsStep(ctx context.Context, open *stores, node string) *inventory.Grant
 		// list is the one already sent.
 		return nil
 	}
-	if _, err := sendRollout(keepingEveryBuild(withScope(ctx, sendScope{})), open, []string{holder}); err != nil {
+	if _, err := sendRollout(keepingEveryBuild(withScope(ctx, sendScope{}), holder), open, []string{holder}); err != nil {
 		fmt.Printf("grants step: the bus's user list could not be sent to %s ahead of %s, which is sent without "+
 			"it — the bus may refuse what the send newly grants: %v\n", holder, node, err)
 		return &inventory.GrantsStep{Node: holder, Failed: err.Error()}