Let the build agent read the gate's pull keys and watch both buckets (issue 1325)

From R3e the gate writes mesh-delivery-gate_pulls and today's bucket stops (ADR 0450 §1). The build agent's manifest
reads both, and a running check's watch listens in every bucket that exists, so a move is heard whichever holds the key.

modules/build-agent/manifest_test.go

@@ -13,6 +13,7 @@ import (
 )
 
 type manifest struct {
+	Reads      []string                   `json:"reads"`
 	Requires   []json.RawMessage          `json:"requires"`
 	Binds      map[string]string          `json:"binds"`
 	Secrets    map[string]string          `json:"secrets"`
@@ -172,3 +173,17 @@ func TestTheJudgeCacheIsADirectoryOfItsOwnMountedAtTheSamePath(t *testing.T) {
 		t.Fatalf("the judge cache: directory %v, data %v, env %v, mounted at the same path %v", dir, data, env, mounted)
 	}
 }
+
+// A running check's watch reads the pull requests' keys in the gate's bucket and in mesh-delivery's, so it
+// stays sighted whichever of them the keys are written to (novox/hq ADR 0450 §1, issue 1325 AC1).
+func TestTheAgentReadsTheGatesPullKeysAndTodaysBoth(t *testing.T) {
+	got := map[string]bool{}
+	for _, r := range read(t).Reads {
+		got[r] = true
+	}
+	for _, want := range []string{"mesh-delivery-gate.pulls", "mesh-delivery.pulls"} {
+		if !got[want] {
+			t.Errorf("the build agent does not read %s: %v", want, read(t).Reads)
+		}
+	}
+}