No change to a machine takes effect unseen (hq ADR 0217, to-be 44)

Two incidents had one shape: a change took effect that nobody saw first (hq issues 241, 304).
Three guards, each silent when nothing is at stake:

- settings show [--history], and a set that answers each key it adds, changes and removes, and
  refuses a removal unless --replace; the replaced or cleared layer is kept in settings_history,
  in the same transaction as the write (migration 0078).
- every send keeps a summary of what it sent (no file content), plan <node> --diff compares with
  it, and push with no machine is refused unless --all.
- a push that would give a running container's mount another host directory holds that machine,
  naming the module, mount and both directories, until push <node> --move <module>; a named push's
  cascade is held the same way.

Rebased onto main and fitted to it: the hold runs before the push says what it recreates, a whole
push still says so first and leaves machines waiting for a gate, the verb's push with no machine is
still --behind and a push still needs why. The verbs take plan diff, settings replace and history,
and push move beside a machine, each refused where it cannot take effect.

cmd/mesh-controller/held_back.go

@@ -179,7 +179,7 @@ func sayHeld(w io.Writer, node string, why []string) {
 // machines that could not be composed, as refusals.
 func flushBehind(ctx context.Context, open *stores, nodes []inventory.Node, handled map[string]bool,
 	compose func(held context.Context, node string) (sendable, error), d delivery, holder string,
-	w io.Writer) ([]string, error) {
+	keep keeping, w io.Writer) ([]string, error) {
 	inv := open.inventory
 	var refusals []string
 	// Bounded by the node count: a node is marked handled the round it is considered and is never
@@ -237,7 +237,7 @@ func flushBehind(ctx context.Context, open *stores, nodes []inventory.Node, hand
 		// a refusal and reported at the end, and the others are still sent (novox/hq ADR 0066).
 		// Held for this round only, and after the last round's were given back, so two pushes
 		// cascading into each other's machines never each wait on the other.
-		refused, err := sendRound(ctx, open, sending, compose, d, holder)
+		refused, err := sendRound(ctx, open, sending, compose, d, holder, keep)
 		refusals = append(refusals, refused...)
 		if err != nil {
 			return refusals, err