Read the SDK fixtures at the pin of the tree under check, not the running controller's (issue 449 review)

A pull request moving the SDK passed its check against the old SDK and then failed
everywhere once it rolled out. In a merge check the test now reads the clone's history
at the tree's own go.mod pin, and holds the captured copy to the clone byte for byte.

cmd/mesh-controller/checks.go

@@ -276,8 +276,10 @@ func checkRequestFor(ctx context.Context, open *stores, p link.PullUpdated, scop
 // builds from; and beside the controller its main, for a judge the running controller predates, and the
 // lab's main, whose replays every check runs. **One rule, read by the check the controller asks for and by
 // the facts snapshot** (Facts.Beside), so a check run by hand clones what the build seat clones. Beside the
-// controller also the SDK, at the commit the controller's go.mod pins (sdkPinned): its conformance fixtures
-// are judged against the SDK the controller is built with, not one a desktop holds (novox/hq issue 449).
+// controller also the SDK, checked out at the commit the running controller's go.mod pins (sdkPinned), not
+// one a desktop holds (novox/hq issue 449). The checkout only places the clone: the conformance test reads the
+// fixtures at the pin of the tree under check, from the clone's history, so a pull request moving the SDK is
+// judged against the SDK it moves to (internal/link/conformance_test.go).
 func besideRefs(dir, running string) map[string]string {
 	switch dir {
 	case "mesh-catalog":