A command opens each store once, not once per machine

Working out what a machine should be reaches the identity context for its
certificate and the licence context for its model access. Both were opened —
and waited on — inside functions called for every node in a push. Two machines
hid it. Fifty would be fifty connect-and-wait cycles for data that does not
change while the push runs.

So a command holds what it has open, and passes it. Each context is opened on
first use rather than up front, because most commands need one and paying to
reach three would be the same waste from the other side.

The contexts stay separate, which is the point: this is one struct holding
three connections to three databases, not one connection to a shared one. No
context reaches another's store, and each still holds only its own credential
(novox/hq ADR 0008).

A pure move again — the gate is green before and after, and no test changed.

cmd/mesh-control/stores.go

@@ -60,11 +60,12 @@ func migrate(ctx context.Context) error {
 	// The modules the control plane ships with itself. Recorded here rather than by hand, because
 	// a mesh whose own private network is missing from the catalogue would have nothing to assign
 	// and no way to say why.
-	inv, err := openInventory(ctx)
+	open, err := openStores(ctx)
 	if err != nil {
 		return err
 	}
-	defer inv.Close()
+	defer open.Close()
+	inv := open.inventory
 	for _, m := range provided {
 		if err := inv.Provide(ctx, m); err != nil {
 			return err
@@ -111,3 +112,67 @@ func openLicences(ctx context.Context) (*licences.Licences, error) {
 	}
 	return held, nil
 }
+
+// stores is what one command has open.
+//
+// **Opened once, not once per machine.** Working out what a machine should be reaches the identity
+// context for its certificate and the licence context for its model access, and both were opened —
+// and waited on — inside functions called for every node in a push. Two machines hid it; fifty
+// would be fifty connect-and-wait cycles for data that does not change while the push runs.
+//
+// Each is opened on first use rather than up front, because most commands need one context and
+// paying to reach three would be the same waste from the other side.
+type stores struct {
+	inventory *inventory.Inventory
+	identity  *identity.Identity
+	licences  *licences.Licences
+}
+
+// open connects to the inventory, which every command that touches the mesh needs.
+func openStores(ctx context.Context) (*stores, error) {
+	inv, err := openInventory(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return &stores{inventory: inv}, nil
+}
+
+// Identity is this control plane's own identity context, opened if it has not been.
+func (h *stores) Identity(ctx context.Context) (*identity.Identity, error) {
+	if h.identity != nil {
+		return h.identity, nil
+	}
+	opened, err := openIdentity(ctx)
+	if err != nil {
+		return nil, err
+	}
+	h.identity = opened
+	return opened, nil
+}
+
+// Licences is the context holding model access, opened if it has not been.
+func (h *stores) Licences(ctx context.Context) (*licences.Licences, error) {
+	if h.licences != nil {
+		return h.licences, nil
+	}
+	opened, err := openLicences(ctx)
+	if err != nil {
+		return nil, err
+	}
+	h.licences = opened
+	return opened, nil
+}
+
+// Close lets go of everything that was opened, in any order: they are separate connections to
+// separate databases and none of them knows about the others.
+func (h *stores) Close() {
+	if h.licences != nil {
+		h.licences.Close()
+	}
+	if h.identity != nil {
+		h.identity.Close()
+	}
+	if h.inventory != nil {
+		h.inventory.Close()
+	}
+}