Report a provider that keeps failing a consumer in status (hq ADR 0224)

The identity provider failed every consumer for a day and status called the
mesh well (hq issue 179). The controller now follows every provider's
provisioner.failing/recovered, keeps the newest failing word per provider,
machine and consumer (migration 0065), and status, its JSON and node show
name it until it recovers. Every module that receives contributions is
granted the two events, so no manifest can forget them.

internal/link/receive_nats.go

@@ -53,7 +53,7 @@ func Nats(js *broker.JetStream) Inbound {
 // whatever was asked for — and not at all when nothing was.
 func (n *natsInbound) Also(kind string) error {
 	switch kind {
-	case KindModuleMoved, KindCatchUp, KindSourceMoved:
+	case KindModuleMoved, KindCatchUp, KindSourceMoved, KindProvisioner:
 		n.follows[kind] = true
 		return nil
 	default:
@@ -241,9 +241,30 @@ func kindOfSubject(subject string) (string, bool) {
 		// runs (ADR 0190): the old builder still answers on the retired seat until it is unassigned.
 		return KindBuilt, true
 	}
+	if _, ok := ProvisionerEmitter(subject); ok {
+		return KindProvisioner, true
+	}
 	return "", false
 }
 
+// ProvisionerEmitter is the module a provider's standing event came from, read from its subject
+// (`mesh.mod.<module>.event.provisioner.<failing|recovered>`); false for any other subject. The
+// controller's own follow pattern, with `*` for the module, decodes too.
+func ProvisionerEmitter(subject string) (string, bool) {
+	rest, ok := strings.CutPrefix(subject, "mesh.mod.")
+	if !ok {
+		return "", false
+	}
+	module, event, ok := strings.Cut(rest, ".event.")
+	if !ok || module == "" || strings.Contains(module, ".") {
+		return "", false
+	}
+	if event != broker.ProvisionerFailing && event != broker.ProvisionerRecovered {
+		return "", false
+	}
+	return module, true
+}
+
 // natsControl is one message from the bus being built, as the controller reads it.
 type natsControl struct {
 	kind string
@@ -256,8 +277,9 @@ type natsControl struct {
 	delivered uint64
 }
 
-func (m *natsControl) Kind() string { return m.kind }
-func (m *natsControl) Body() []byte { return m.msg.Data }
+func (m *natsControl) Kind() string    { return m.kind }
+func (m *natsControl) Body() []byte    { return m.msg.Data }
+func (m *natsControl) Subject() string { return m.msg.Subject }
 
 // Redelivered is what the server counted, not what the controller remembers. Which is the answer to
 // a question the AMQP side could only guess at across a restart: an enrolment redelivered because