A command opens each store once, not once per machine

Working out what a machine should be reaches the identity context for its
certificate and the licence context for its model access. Both were opened —
and waited on — inside functions called for every node in a push. Two machines
hid it. Fifty would be fifty connect-and-wait cycles for data that does not
change while the push runs.

So a command holds what it has open, and passes it. Each context is opened on
first use rather than up front, because most commands need one and paying to
reach three would be the same waste from the other side.

The contexts stay separate, which is the point: this is one struct holding
three connections to three databases, not one connection to a shared one. No
context reaches another's store, and each still holds only its own credential
(novox/hq ADR 0008).

A pure move again — the gate is green before and after, and no test changed.

cmd/mesh-control/rotate.go

@@ -42,11 +42,12 @@ func rotateCommand(ctx context.Context, args []string) error {
 	}
 	provision := positionals[0]
 
-	inv, err := openInventory(ctx)
+	open, err := openStores(ctx)
 	if err != nil {
 		return err
 	}
-	defer inv.Close()
+	defer open.Close()
+	inv := open.inventory
 
 	holders, err := inv.HoldersOf(ctx, provision, *only)
 	if err != nil {
@@ -101,7 +102,7 @@ func rotateCommand(ctx context.Context, args []string) error {
 	// honest thing is to make it as short as the broker allows and to never leave it open across
 	// a command boundary, where it depends on somebody's memory.
 	fmt.Printf("\nsending to both ends:\n")
-	if err := sendTo(ctx, inv, machines); err != nil {
+	if err := sendTo(ctx, open, machines); err != nil {
 		return fmt.Errorf(
 			"%w\n\nThe old credentials are gone from the mesh and the new ones have not arrived. "+
 				"Nothing on those machines has changed yet, so what is running keeps working "+