Build a check's builds for its merge where the host's container engine sees them (hq issue 713)

The check built in a temporary directory of the build holder's container, which the
host's engine mounted empty: every check build failed and every walk built again.

internal/builder/check.go

@@ -357,13 +357,16 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 	// **What the merge would move is built from a checkout nothing of the check touches** (novox/hq issue 703): the
 	// gate and the repository's own check run in containers that mount the workspace read-write, so they can change
 	// its tree, its objects and its caches. The builds are made from a copy of the merge's objects, cloned before
-	// anything of the change runs, outside the workspace — so what is kept under a key is what the key describes.
-	building, buildingTree := "", ""
+	// anything of the change runs, outside the workspace — so what is kept under a key is what the key describes. Each
+	// build's working copy is cloned from it into the workspace only after the check has ended (forTheMerge): the
+	// host's container engine sees no other directory of the holder's (novox/hq issue 713).
+	buildingTree := ""
 	if len(spec.Builds) > 0 && spec.BuildWith != nil && len(spec.Group) == 0 {
 		at := judged.Merge
 		if at == "" {
 			at = spec.Ref
 		}
+		var building string
 		building, buildingTree, err = checkoutForTheBuilds(ctx, run, tree, at, workspace)
 		if err != nil {
 			return CheckVerdict{}, err
@@ -622,23 +625,35 @@ func Check(ctx context.Context, run Runner, spec CheckSpec, workspace, registry
 	// **What the merge would move, built once, here** (novox/hq ADR 0350 §1): after the judging, from the merge it
 	// judged, into the scratch namespace — so the walk of the merge commit takes it rather than building again.
 	if len(spec.Builds) > 0 && spec.BuildWith != nil && len(spec.Group) == 0 {
-		if why := skipsTheBuilds(v); why != "" {
-			say("check", "%s", why)
-		} else {
-			began := time.Now()
-			v.Built = buildForTheMerge(ctx, run, spec, *spec.BuildWith, building, buildingTree, judged.Merge, judged, forge,
-				func(step, message string) {
-					if log != nil {
-						log(step, redact.redact(message))
-					}
-				}, say)
-			say("check", "built for the merge: %d of %d module(s) (%s)", builtCount(v.Built), len(v.Built),
-				time.Since(began).Round(time.Second))
-		}
+		v.Built = forTheMerge(ctx, run, spec, v, workspace, buildingTree, judged, forge, func(step, message string) {
+			if log != nil {
+				log(step, redact.redact(message))
+			}
+		}, say)
 	}
 	return named(v), nil
 }
 
+// forTheMerge builds what the merge moves once the check has judged it, from merged — the copy of the merge
+// checkoutForTheBuilds made outside the workspace — **in the builder's own workspace** (novox/hq issue 713). A build's
+// containers are run by the host's container engine, which mounts a path as the host names it: the build seat's
+// holder runs in a container that shares only its workspace with the host, at the same path, so a working copy in
+// its own temporary directory reaches the toolchain as an empty directory ("go.mod file not found"), every check
+// build failed, and every walk built again. The copy stays outside the workspace, so nothing the tests ran reaches it;
+// the working copy cloned from it is made only now, after every container of the check has ended.
+func forTheMerge(ctx context.Context, run Runner, spec CheckSpec, verdict CheckVerdict, workspace, merged string,
+	judged CheckVerdict, forge GitCredential, log Log, say func(step, format string, args ...any)) []CheckBuilt {
+	if why := skipsTheBuilds(verdict); why != "" {
+		say("check", "%s", why)
+		return nil
+	}
+	began := time.Now()
+	built := buildForTheMerge(ctx, run, spec, *spec.BuildWith, workspace, merged, judged.Merge, judged, forge, log, say)
+	say("check", "built for the merge: %d of %d module(s) (%s)", builtCount(built), len(built),
+		time.Since(began).Round(time.Second))
+	return built
+}
+
 // checkoutForTheBuilds is a clone of the commit a check builds for its merge, made before anything of the check runs,
 // outside the workspace its containers mount (novox/hq issue 703): the directory to remove, and the clone in it.
 // Cloned over git's own transport, never by linking the objects: what the check's containers later write into the