Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

A copied base was named only in what a build stood on, and nowhere when the build failed,
so the store's sweep could never let one go (hq issue 321). One repository per upstream
image stops each module asking the public registry for the same image again, and letting
an index go now takes its own platform manifests, which otherwise kept every byte. A
person can record the copies no record names through the new mirrors verb (hq ADR 0257).

The forge test fix is the same commit as on feat/plain-notifications: main fails without it.

internal/link/build.go

@@ -215,6 +215,10 @@ type BuildResult struct {
 	// (novox/hq ADR 0009). The catalogue turns these into edges; nothing else need care.
 	Against []string `json:"against,omitempty"`
 
+	// Mirrored is every base this build copied into the artifact store, as pinned (novox/hq ADR
+	// 0257). Carried on a failed build too: the copy is in the store whether the build worked or not.
+	Mirrored []string `json:"mirrored,omitempty"`
+
 	// Read is every repository this build read source from besides the module's own. A module whose
 	// recipe packages source that lives elsewhere is affected when that repository moves, and the
 	// manifest the mesh keeps says nothing about it (novox/hq 04-ISSUES/131).