A seat is handed over as one act, and the holder is on record

`seat <name> --to <node>/<module>` makes one assignment the holder of a seat in
the same write that removes the previous one. The row is new (migration 0039);
without one, the resolver derives the holder as it always did — the sole eligible
assignment, two refused — so nothing changes for a mesh that never hands a seat
over. With one, the recorded assignment holds and any other whose module could
hold the seat is eligible and silent: not refused, not holding. That is what lets
the next holder run beside the current one until the switch (hq design 26, design
28 task 5.3, ADR 0131).

Why: the controller finds its own bus through a seat, and the day that seat was
left with nobody in it — because two eligible holders could not coexist and the
old one's claim was taken away — the control plane looped for two hours while
every service stayed up. A handover that is never empty in between is the fix,
not a workaround for it.

`CanHold` is the one judgement of whether a module may hold a seat — claims it at
its scope, provides what it delivers, against the store's row — shared by
registration and the handover so they cannot drift apart. The holding belongs to
the assignment and goes when it does, so a seat never points at nothing running.

Tests: the resolver with and without a record, on the same and another machine,
under a former name; the store's row replaced not added, refused for an
unassigned target, removed with its assignment; CanHold's four answers and that
they follow the store. Full suite green against a real NATS and store.

internal/inventory/migrations/0039-a-seat-is-held-by-one-assignment-on-record.sql

@@ -0,0 +1,24 @@
+-- A seat's holder is a recorded fact, not a derivation (novox/hq ADR 0131, design 26).
+--
+-- Until this, "which assignment holds the seat" was derived: the module that is assigned and
+-- claims the seat holds it, and a second eligible assignment was refused at resolution. That has no
+-- way to hand a seat from one holder to the next without a moment where nothing holds it — and the
+-- control plane finds its own bus through one of these seats, so that moment was an outage
+-- (2026-09-27). Now the holder is one row here, changed by `seat <name> --to <node>/<module>` as one
+-- act, and other assignments whose module could hold the seat are simply eligible and silent.
+--
+-- No row means what it always meant: the sole eligible assignment holds the seat, and two eligible
+-- ones are refused. So a mesh that has never handed a seat over behaves exactly as before, and the
+-- row appears the first time somebody does.
+--
+-- The seat is referenced by name because claims still are (0034); the rename cascades here so a
+-- handed-over seat survives being renamed. The holder is the assignment itself, so unassigning it
+-- takes the holding with it and the seat falls back to derivation rather than pointing at nothing.
+create table seat_holding (
+  seat   text        primary key references seat(name) on update cascade on delete cascade,
+  scope  text        not null,
+  node   uuid        not null,
+  module text        not null,
+  since  timestamptz not null default now(),
+  foreign key (node, module) references assignment(node, module) on delete cascade
+);