Seats keep their former names, so a rename breaks nothing (ADR 0122, phase 2)

Phase 1 made the set data; a rename still broke every reference to the old
name. This adds the stable identity: a seat's canonical name changes and its
old name becomes an alias that resolves to it forever. SeatNamed and the holder
and display matching resolve a name (former or current) to its seat, so a
manifest's claim, a held record, the git-seat lookup and the build machine's
embedded set all go on working unchanged after a rename. seat_alias table
(migration 0035), inventory Aliases/RenameSeat, openInventory loads them, and a
'seat rename <from> <to>' command does the whole thing — one operation, no
rebuild, no re-registration, no freeze. Behaviour-neutral until a seat is
renamed. Validated against postgres.

internal/inventory/seats_test.go

@@ -76,3 +76,40 @@ func TestReSeedingAnUnchangedSetIsANoOp(t *testing.T) {
 		}
 	}
 }
+
+// A rename is one operation: the seat gets the new name, the old name becomes an alias that still
+// resolves to it (novox/hq ADR 0122).
+func TestRenameSeatKeepsTheFormerNameAsAnAlias(t *testing.T) {
+	inv := ForTest(t)
+	if _, err := inv.SeedSeats(t.Context(), catalogue.DefaultSeats()); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.RenameSeat(t.Context(), "node-packet-filter", "node-firewall"); err != nil {
+		t.Fatal(err)
+	}
+	seats, err := inv.Seats(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	names := map[string]bool{}
+	for _, s := range seats {
+		names[s.Name] = true
+	}
+	if !names["node-firewall"] || names["node-packet-filter"] {
+		t.Fatalf("the seat was not renamed in place: %v", names)
+	}
+	aliases, err := inv.Aliases(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if aliases["node-packet-filter"] != "node-firewall" {
+		t.Fatalf("the former name is not an alias of the new one: %v", aliases)
+	}
+	// Renaming what has no seat is refused; renaming to the same name is refused.
+	if err := inv.RenameSeat(t.Context(), "no-such-seat", "x"); err == nil {
+		t.Fatal("renaming a seat that does not exist was accepted")
+	}
+	if err := inv.RenameSeat(t.Context(), "node-firewall", "node-firewall"); err == nil {
+		t.Fatal("renaming a seat to its own name was accepted")
+	}
+}