Report a provider that keeps failing a consumer in status (hq ADR 0224)

The identity provider failed every consumer for a day and status called the
mesh well (hq issue 179). The controller now follows every provider's
provisioner.failing/recovered, keeps the newest failing word per provider,
machine and consumer (migration 0065), and status, its JSON and node show
name it until it recovers. Every module that receives contributions is
granted the two events, so no manifest can forget them.

internal/link/receive.go

@@ -34,6 +34,9 @@ const (
 	// built without anybody telling the mesh (novox/hq 04-ISSUES/131).
 	KindSourceMoved = "source-moved"
 	KindCatchUp     = "catch-up"
+	// KindProvisioner is a provider saying a consumer has failed for minutes, or recovered
+	// (novox/hq ADR 0224).
+	KindProvisioner = "provisioner"
 )
 
 // Control is one thing a node or a module said, as the controller must act on it.
@@ -54,6 +57,11 @@ type Control interface {
 	// Body is the message itself — the payload alone, never the envelope.
 	Body() []byte
 
+	// Subject is where it was published. For a module's event it names the emitter, which the bus
+	// enforces (only a module may publish into its own namespace), so who said it is read from here
+	// and never from the body.
+	Subject() string
+
 	// Redelivered says the bus has handed this message over before. An enrolment cares and
 	// nothing else does: one already spent is not finished a second time.
 	Redelivered() bool