Answer what the records keep, collect on a person's word, and name a machine's images (hq ADR 0251)

The store's tools and a machine's image pruning decide from the records, so
the controller says them: artifacts (every recorded artifact, kept and why,
eligible, collected on request), collect (the after-build sweep on demand,
a dry run unless confirmed with a why, recorded as a hand act) and images
(what a machine's declaration names, now and as last sent). The sweep is one
implementation with two sets of bounds.

cmd/mesh-controller/unseen.go

@@ -87,6 +87,10 @@ type sentResource struct {
 	// Volumes is a container's mounts as sent — paths, which are not secrets, and what a moved
 	// data directory is read from.
 	Volumes []string `json:"volumes,omitempty"`
+	// Image is a container's image as sent — a reference, not a secret — so the machine can be told
+	// which images its last declaration named, and keep them (novox/hq ADR 0251, `images`). Absent in
+	// a summary kept before it was.
+	Image string `json:"image,omitempty"`
 }
 
 // summarize is what is kept of a declaration body: its resources, in the order sent.
@@ -105,6 +109,9 @@ func summarize(body []byte) ([]sentResource, error) {
 			s.Fields[k] = digestValue(v)
 		}
 		if s.Type == "container" {
+			if image, ok := r["image"].(string); ok {
+				s.Image = image
+			}
 			if vols, ok := r["volumes"].([]any); ok {
 				for _, v := range vols {
 					s.Volumes = append(s.Volumes, fmt.Sprint(v))