Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

A copied base was named only in what a build stood on, and nowhere when the build failed,
so the store's sweep could never let one go (hq issue 321). One repository per upstream
image stops each module asking the public registry for the same image again, and letting
an index go now takes its own platform manifests, which otherwise kept every byte. A
person can record the copies no record names through the new mirrors verb (hq ADR 0257).

The forge test fix is the same commit as on feat/plain-notifications: main fails without it.

internal/catalogue/verbs.go

@@ -457,6 +457,19 @@ var ControllerVerbs = []Verb{
 			"why":     "with confirm: why — required, and recorded in the hand-act log",
 			"most":    "let go of at most this many (500 by default, at most 5000)",
 		}, nil, "confirm")},
+	{Name: "mirrors", Description: "The bases the mesh copied into its artifact store for builds to stand on, as " +
+		"the records hold them: each with its state — kept because a kept build stood on it, or eligible — and " +
+		"which build or person recorded it. With record: references of copies no record names (a copy made " +
+		"before copies were recorded, or by a build that failed before then) to record as the mesh's, so the " +
+		"sweep keeps or lets go of them like any other; only a repository the mirror writes is taken " +
+		"(upstream/<host>/<path>, or a module's <module>/on-<argument>), and each must be in the store. Without " +
+		"confirm a dry run; with confirm and why, recorded — a hand act. Records only: nothing is deleted " +
+		"(novox/hq ADR 0257).",
+		Input: schema(map[string]string{
+			"record":  "references to record, artifact-store://<repository>@sha256:<hex>, separated by spaces or commas",
+			"confirm": "\"true\": record them (needs why); without it nothing is recorded",
+			"why":     "with confirm: why — required, and recorded with each copy and in the hand-act log",
+		}, nil, "confirm")},
 	{Name: "images", Description: "Every container image one machine's declaration names — the declaration the " +
 		"mesh would send it now and the one it was last sent — each with the resources naming it: what the " +
 		"machine keeps when it prunes its images. sent_known is false when the last one sent is not kept with " +