Assemble merges in a rolling window and walk each batch once (hq ADR 0276, issue 362)

Every merge opened a walk and the next merge of the branch superseded it: two
catalogue merges 18 s apart left a walk no delivery held, and the operator
started it by hand 58 minutes later. A merge now joins the open batch, kept in
the store (migration 0089), which is cut into one walk when no merge came for
merge-window (90 s) or at merge-window-at-most (10 min): one commit per
repository, the latest of its branch, with every file the batch's merges
changed. One walk at a time; a started walk is never superseded, a waiting one
is folded into the next. The walk names every merge it answers on the wire
(delivery.merges, taken_over_by, batch). A failed walk walks its earlier merges
alone, newest first, until one is delivered. A delivery group's order becomes
tier edges inside the walk. plans shows the batch assembling; S18 and S19
bound its waits; S16 names the merges a waiting walk answers.

internal/inventory/migrations/0089-merges-are-assembled-in-a-rolling-window.sql

@@ -0,0 +1,28 @@
+-- Merges are assembled in a rolling window, and each batch is delivered by one walk (novox/hq ADR 0276,
+-- issue 362).
+--
+-- Every merge opened a walk of its own, and the next merge of the branch superseded it: two catalogue merges
+-- eighteen seconds apart on 2026-10-10 left a walk nobody gave its word, and the operator started it by hand
+-- 58 minutes later. A merge now joins the open batch, which is cut into one walk when no merge came for the
+-- window's length, with at most one commit per repository.
+--
+-- A walk names every repository's commit it carries (commits), beside the one its first columns keep for a
+-- reader that knows only one. Null for a walk kept before this: its repository and commit are the whole of it.
+alter table release_plan add column commits jsonb;
+
+-- Every merge the controller heard into a branch a module follows, and the batch or walk that answers it:
+-- what the window is measured from (heard_at), what the cut plans from (event, the forge's announcement), and
+-- what keeps a restarted controller from losing or doubling a merge (the key). plan_id is null for an
+-- earlier merge a failed walk carried, which waits to be walked on its own commit (alone).
+create table batched_merge (
+    repository  text        not null,
+    branch      text        not null,
+    commit_hash text        not null,
+    merged_at   timestamptz,
+    heard_at    timestamptz not null,
+    event       jsonb       not null,
+    plan_id     text,
+    alone       boolean     not null default false,
+    primary key (repository, commit_hash)
+);
+create index batched_merge_plan on batched_merge (plan_id);