A plan sends what it waits for

A tier whose module a later tier is built by waited for the machines running it to report after the
build — and relied on the catalogue's moved event to send them. A rebuild from the same source commit is
not a move the catalogue announces: the build machine rebuilt for a controller change kept its commit,
nothing sent it, and the plan waited on a report that would never come (2026-10-01, 19:45Z). The plan
now sends the machines running a gated module once, records when, and waits for the reports after that.

internal/inventory/plans.go

@@ -33,8 +33,12 @@ type PlanModule struct {
 	State   string     `json:"state,omitempty"`
 	AskedAt *time.Time `json:"asked_at,omitempty"`
 	BuiltAt *time.Time `json:"built_at,omitempty"`
-	Commit  string     `json:"commit,omitempty"`
-	Why     string     `json:"why,omitempty"`
+	// SentAt is when the plan sent the machines running this module its new build, because a
+	// later tier is built by it (ADR 0163's gate): the reports that open the gate are the ones
+	// after this.
+	SentAt *time.Time `json:"sent_at,omitempty"`
+	Commit string     `json:"commit,omitempty"`
+	Why    string     `json:"why,omitempty"`
 }
 
 // The states a plan passes through.