Run a verb from the controller's own running image, and refuse what it cannot run as a handover (hq issue 289)

The witness moves a running build aside into a directory the controller's user
cannot enter, then deletes it; a verb exec'd from os.Executable() in that window
failed with permission denied. /proc/self/exe stays valid while the process lives.
A verb that still cannot start, or arrives while the controller stops, is refused
with link.ErrHandingOver and marked retry: handing-over.

internal/link/calls_test.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log"
 	"strings"
 	"sync"
@@ -177,3 +178,24 @@ func recentOf(l *CallLog) []Call {
 	out, _ := l.Recent()
 	return out
 }
+
+// A call refused because its controller is handing over says so in a mark as well as in words, so the
+// caller asks once more without parsing a sentence (novox/hq issue 289).
+func TestAHandoverRefusalIsMarkedRetryable(t *testing.T) {
+	l, a := NewCallLog(), newAnswers(t)
+	l.serveCall("mesh-controller", "rotate", nil, "_INBOX.x.9", func(context.Context, json.RawMessage) (any, error) {
+		return nil, fmt.Errorf("%w: stopping", ErrHandingOver)
+	}, a.respond, nil)
+	got := a.only()
+	if got["retry"] != RetryHandingOver || !strings.Contains(fmt.Sprint(got["error"]), "handing over") {
+		t.Fatalf("answered %v", got)
+	}
+
+	l, a = NewCallLog(), newAnswers(t)
+	l.serveCall("mesh-controller", "rotate", nil, "_INBOX.x.10", func(context.Context, json.RawMessage) (any, error) {
+		return nil, errors.New("refused for its own reason")
+	}, a.respond, nil)
+	if _, marked := a.only()["retry"]; marked {
+		t.Fatal("an ordinary refusal was marked to be asked again")
+	}
+}