Keep a consumer bound where its data is; only a pin moves it (hq ADR 0232, issue 273)

Issue 258's fix let a mesh seat's holder elsewhere answer before this machine's own provider. Right
for the resolver, which any provider answers alike; for the store's seat it re-bound every database
consumer on a machine running its own store to the holder on another, each was given a fresh, empty
database there, and nothing said so for twenty hours.

- An offer says whether it keeps its consumers' data (`keeps-consumer-data`); unsaid, a provider
  that grants each consumer a credential does. For such a provision the seat's holder no longer
  overrules a provider beside the consumer; a pin still does.
- Where each such consumer was sent is recorded (migration 0071). A resolution that would bind it
  elsewhere keeps the recorded provider and says the move; one whose provider is gone is refused,
  never answered by another.
- A push says a kept move and raises it as an urgent condition at once; the self-check's D12 raises
  it every run, with a pinned move not yet sent as a warning and any unasked move as urgent.

cmd/mesh-controller/plan.go

@@ -90,6 +90,12 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
 	if err != nil {
 		return catalogue.Resolution{}, nil, err
 	}
+	// Where each of its consumers of a provision that keeps data was last sent (novox/hq ADR 0232):
+	// a resolution that would answer one from anywhere else keeps it there, and says so.
+	world.Bound, err = inv.BindingsFor(ctx, nodeName)
+	if err != nil {
+		return catalogue.Resolution{}, nil, err
+	}
 
 	onNetwork, err := whereEveryoneIs(ctx, inv, shelf)
 	if err != nil {
@@ -419,10 +425,35 @@ func declarationWith(ctx context.Context, open *stores, node string,
 			names = append(names, m.Module)
 		}
 		out.Builds = carriedBuilds(names, composed.LeftOut, current, before)
+		out.Bindings = boundToData(plan, composed.LeftOut)
 	}
 	return out, nil
 }
 
+// boundToData is every binding of this machine's consumers to a provision that keeps their data
+// (novox/hq ADR 0232), as a send records it. Not a consumer left out of the declaration: the machine
+// is not told anything new about it, so nothing about where it is bound has been sent.
+func boundToData(plan catalogue.Resolution, leftOut map[string]string) []inventory.Binding {
+	var out []inventory.Binding
+	seen := map[[2]string]bool{}
+	for _, n := range plan.Needs {
+		if !n.KeepsData || n.ByRecord || n.Module == "" {
+			continue
+		}
+		if _, left := leftOut[n.For]; left {
+			continue
+		}
+		key := [2]string{n.For, n.Name}
+		if seen[key] {
+			continue
+		}
+		seen[key] = true
+		out = append(out, inventory.Binding{Machine: plan.Node, Consumer: n.For, Provision: n.Name,
+			Provider: catalogue.Chosen{Node: n.From, Module: n.Module}})
+	}
+	return out
+}
+
 // carriedBuilds is the build of each module a declaration carries, as a send records it (novox/hq
 // issue 259): the module's current build for each module in it, and for a module left out of it
 // (ADR 0163, rule 6) the build it was last sent, since the machine keeps that one — or nothing, when