Land feature 57's controller work on its release branch

The controller plans config, templates and moved providers' provisions,
hands bus accounts to the vault and judges the new manifest words, on the
feature's SDK and node-engine validator (feature 57, config and provisioning).

internal/inventory/core_box_test.go

@@ -0,0 +1,47 @@
+package inventory
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+)
+
+// The box the vault sealed a core credential in is kept per machine, module and name, replaced by a newer one, and
+// gone with its machine (issue 755).
+func TestACoreCredentialsVaultBoxIsKeptPerMachineAndReplaced(t *testing.T) {
+	inv := fresh(t)
+	ctx := context.Background()
+	if _, err := inv.AddNode(ctx, "anchor"); err != nil {
+		t.Fatal(err)
+	}
+	first := CoreBox{Module: "nats", Name: "broker", Generation: 1, SealedTo: "a2V5",
+		Box: json.RawMessage(`{"v":1,"eph":"ZQ==","iv":"aQ==","tag":"dA==","ct":"MQ=="}`)}
+	if err := inv.KeepCoreBox(ctx, "anchor", first); err != nil {
+		t.Fatal(err)
+	}
+	second := first
+	second.Generation, second.Box = 2, json.RawMessage(`{"v":1,"eph":"ZQ==","iv":"aQ==","tag":"dA==","ct":"Mg=="}`)
+	if err := inv.KeepCoreBox(ctx, "anchor", second); err != nil {
+		t.Fatal(err)
+	}
+	kept, err := inv.KeptCoreBoxes(ctx, "anchor")
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := kept["nats"]["broker"]
+	var box map[string]any
+	_ = json.Unmarshal(got.Box, &box)
+	if len(kept) != 1 || got.Generation != 2 || got.SealedTo != "a2V5" || box["ct"] != "Mg==" || got.GotAt.IsZero() {
+		t.Fatalf("kept %+v", kept)
+	}
+	if err := inv.KeepCoreBox(ctx, "nowhere", first); err == nil {
+		t.Error("a box was kept for a machine the mesh does not know")
+	}
+	if err := inv.KeepCoreBox(ctx, "anchor", CoreBox{Module: "nats", Name: "broker", Generation: 3, SealedTo: "a2V5",
+		Box: json.RawMessage(`not json`)}); err == nil {
+		t.Error("a box that is not whole was kept")
+	}
+	if others, err := inv.KeptCoreBoxes(ctx, "laptop"); err != nil || len(others) != 0 {
+		t.Errorf("another machine has %v, %v", others, err)
+	}
+}