Read a rebuild of an unchanged source as no move, whatever image digest it made (hq issue 280)

An image is not byte-reproducible, so ADR 0236's 'same artifacts is no move'
never held for one: a catalogue merge that did not touch the bus rebuilt it,
and every send to the control node waited for a planned bus upgrade.

The builder now records a source fingerprint per build (module tree, context
trees, bases and toolchains by digest). A rebuild with the fingerprint of the
build it repeats is registered with that build's artifacts, handed to modules
standing on it, holds no push, demands no bus step, and a plan sends and
gates nothing for it. Identical artifacts remain a second way to be no move.

cmd/mesh-builder/main.go

@@ -292,6 +292,7 @@ func answer(ctx context.Context, publisher builder.Publisher, on, workspace stri
 				})
 			}
 			result.Against = built.Against
+			result.SourceFingerprint = built.Source
 			for _, r := range built.Read {
 				result.Read = append(result.Read, link.ReadRepository{Repository: r.Repository, Ref: r.Ref})
 			}

cmd/mesh-builder/once.go

@@ -105,6 +105,7 @@ func buildOnce(ctx context.Context, args []string) error {
 		Ref:        *ref,
 		Manifest:   built.Manifest,
 		Against:    built.Against,
+		Source:     built.Source,
 	}
 	for _, r := range built.Read {
 		out.Read = append(out.Read, readRepository{Repository: r.Repository, Ref: r.Ref})
@@ -135,6 +136,7 @@ type onceResult struct {
 	Made       []madeArtifact   `json:"made"`
 	Against    []string         `json:"against,omitempty"`
 	Read       []readRepository `json:"read,omitempty"`
+	Source     string           `json:"source-fingerprint,omitempty"`
 }
 
 // readRepository is a repository this build read source from besides the module's own.