Register only from a protected trunk of the same repository, and mark the serving controller never the terminal

A source repository's name is not its identity, and a trunk anyone may push
to makes the trunk rule mean nothing (the review of 2026-10-09). Through any
verb a module now registers only from a repository on the mesh's forge whose
trunk refuses direct pushes, requires a status and lets no administrator
merge past one, asked of the forge's own tools; and only from the repository
by the forge's id, recorded at registration (migration 0084), so one deleted
and made again under the name is refused. The serving controller marks its
environment, so nothing it runs or starts reads as the terminal, and a
terminal request covers only the repository and path it asked.

internal/inventory/pending.go

@@ -88,16 +88,17 @@ func (i *Inventory) RecordBuildRequest(ctx context.Context, a BuildRequest) erro
 	return err
 }
 
-// AskedAtTheTerminal says whether the build of this id was kept as asked at the controller's terminal (novox/hq
-// ADR 0266). False for a build no request was kept for — a check, a dry run, an outcome nobody here asked for —
-// and for every request asked through a verb.
-func (i *Inventory) AskedAtTheTerminal(ctx context.Context, id string) (bool, error) {
-	var at bool
-	err := i.store.Pool().QueryRow(ctx, `select at_terminal from build_request where id = $1`, id).Scan(&at)
+// BuildRequestByID is the build request kept under this id, and whether one was kept.
+func (i *Inventory) BuildRequestByID(ctx context.Context, id string) (BuildRequest, bool, error) {
+	var a BuildRequest
+	err := i.store.Pool().QueryRow(ctx,
+		`select id, repository, seat, source_path, ref, commit_hash, asked_for, at_terminal, asked_at
+		   from build_request where id = $1`, id).Scan(&a.ID, &a.Repository, &a.Seat, &a.Path, &a.Ref, &a.Commit,
+		&a.For, &a.AtTerminal, &a.At)
 	if errors.Is(err, pgx.ErrNoRows) {
-		return false, nil
+		return BuildRequest{}, false, nil
 	}
-	return at, err
+	return a, err == nil, err
 }
 
 // MarkNotAsked says a kept build request was never handed over: the words are kept, unless its outcome was