Keep mesh-lab at its trunk and build the release judge with a cache of its own

Review of #329: mesh-lab's replays run with the container runtime's socket, so
a same-named branch must never be what runs there; the shared Go cache and HOME
are writable by a pull request's own script, so the judge kept for a head must
not be built from them (issue 704, issue 482). A forge answer naming no branch
is an error, and a trunk is the branch a repository follows, not a name.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/mesh-controller/release_branch_test.go

@@ -125,8 +125,9 @@ func TestBesideAReleaseBranchCheckEachRepositoryIsReadAtThatBranchElseItsTrunk(t
 		"mesh-host":    at("mesh-host", aRelease, "main"),
 		"mesh-tools":   at("mesh-tools", aRelease, "main"),
 		"mesh-catalog": at("mesh-catalog", aRelease, "main"),
-		"mesh-lab":     at("mesh-lab", aRelease, "main"),
-		"mesh-sdk":     at("mesh-sdk", aRelease, "main"),
+		// mesh-lab at its trunk, always: its replays run with the container runtime's socket.
+		"mesh-lab": at("mesh-lab", "main", ""),
+		"mesh-sdk": at("mesh-sdk", aRelease, "main"),
 	}
 	if !reflect.DeepEqual(beside, want) {
 		t.Fatalf("beside a release-branch check:\n got %v\nwant %v", beside, want)
@@ -193,3 +194,70 @@ func TestAReleaseBranchsPullRequestIntoItsTrunkIsCheckedAsAnyTrunkPullRequest(t
 		}
 	}
 }
+
+// **A forge answer that names no branch is an error**, never "no release branch"; a 404 is "no such branch".
+func TestTheForgesAnswerAboutABranchIsReadStrictly(t *testing.T) {
+	for _, c := range []struct {
+		what   string
+		answer link.Answer
+		has    bool
+		fails  bool
+	}{
+		{"the branch named", link.Answer{Result: []byte(`{"result":{"name":"` + aRelease + `"}}`)}, true, false},
+		{"not found", link.Answer{Error: "Gitea API /repos/novox/mesh-controller/branches/x: 404 {\"message\":\"not found\"}"},
+			false, false},
+		{"an empty branch name", link.Answer{Result: []byte(`{"result":{"name":""}}`)}, false, true},
+		{"no result", link.Answer{Result: []byte(`{}`)}, false, true},
+		{"another branch named", link.Answer{Result: []byte(`{"result":{"name":"main"}}`)}, false, true},
+		{"unreadable", link.Answer{Result: []byte(`not json`)}, false, true},
+		{"another error", link.Answer{Error: "Gitea API: 500 internal"}, false, true},
+	} {
+		has, err := branchAnswered(c.answer, aRelease)
+		if has != c.has || (err != nil) != c.fails {
+			t.Errorf("%s: has %v, error %v", c.what, has, err)
+		}
+	}
+}
+
+// **The trunk is the repository's own, not a name**: a repository whose trunk is not main, one that follows main, and
+// a controller whose trunk is not main.
+func TestATrunkIsTheBranchTheRepositoryFollows(t *testing.T) {
+	asked := aForgeWithBranches(t, map[string][]string{"novox/mesh-controller": {"main", aRelease, "master"}}, nil)
+	legacy := fromRepo("legacy", "novox/legacy", "")
+	legacy.Source.Ref = "master"
+	onMain := fromRepo("photos", "novox/photos", "")
+	onMain.Source.Ref = "main"
+	entries := append(theCore(), legacy, onMain)
+	for _, c := range []struct {
+		what, repo, base, release string
+		asks                      int
+	}{
+		{"a repository whose trunk is master, into master", "legacy", "master", "", 0},
+		{"a repository whose trunk is master, into the release branch", "legacy", aRelease, aRelease, 1},
+		{"a repository whose module follows main, into main", "photos", "main", "", 0},
+		{"a repository whose module follows main, into the release branch", "photos", aRelease, aRelease, 1},
+	} {
+		*asked = 0
+		p := link.PullUpdated{Owner: "novox", Repo: c.repo, Base: c.base, Commit: "abc", Paths: []string{"x"}}
+		got, err := releaseBranchOf(t.Context(), p, pullScope(p, entries, nil, nil), entries)
+		if err != nil || got != c.release || *asked != c.asks {
+			t.Errorf("%s: release %q (%v) after %d question(s), not %q after %d", c.what, got, err, *asked, c.release, c.asks)
+		}
+	}
+
+	// A controller whose trunk is not main: main may be a release branch there, and its own trunk never is.
+	core := theCore()
+	core[0].Source.Ref = "trunk"
+	for _, c := range []struct {
+		base, release string
+		asks          int
+	}{{"trunk", "", 0}, {"main", "main", 1}} {
+		*asked = 0
+		p := link.PullUpdated{Owner: "novox", Repo: "hq", Base: c.base, Commit: "abc", Paths: []string{"x"}}
+		got, err := releaseBranchOf(t.Context(), p, pullScope(p, core, nil, nil), core)
+		if err != nil || got != c.release || *asked != c.asks {
+			t.Errorf("hq into %s, the controller following trunk: release %q (%v) after %d question(s)", c.base, got, err,
+				*asked)
+		}
+	}
+}