Land feature 57's controller work on its release branch

The controller plans config, templates and moved providers' provisions,
hands bus accounts to the vault and judges the new manifest words, on the
feature's SDK and node-engine validator (feature 57, config and provisioning).

internal/link/events.go

@@ -81,6 +81,13 @@ const (
 	// steps from. Said after every save of the serving controller; a delivery's holder also asks for the
 	// walks it follows, so a save made elsewhere is found by comparison, never lost.
 	KeyPlanMoved = "plan-moved"
+	// KeyAssignmentChanged and KeyDeclaredConfigChanged: a key of the controller's assignments or declared-config
+	// mirror was written or removed (novox/hq ADR 0289, design 54 §3, design 57 F3): which key, how and at which
+	// revision of the bucket — never the value, which the bucket holds.
+	KeyAssignmentChanged     = "assignment-changed"
+	KeyDeclaredConfigChanged = "declared-config-changed"
+	// KeyPredefinedChanged: the predefined-keys mirror's one key was written (design 57 K3): a newer list kept.
+	KeyPredefinedChanged = "predefined-changed"
 )
 
 // Applied is what a machine now runs, as the mesh states it.
@@ -172,10 +179,13 @@ type Announcement struct {
 // which branch, producing which commit. The mesh matches it against every module's recorded
 // source and builds what moved, bases first.
 type SourceMoved struct {
-	Owner    string `json:"owner"`
-	Repo     string `json:"repo"`
-	Base     string `json:"base"`
-	Head     string `json:"head"`
+	Owner string `json:"owner"`
+	Repo  string `json:"repo"`
+	Base  string `json:"base"`
+	Head  string `json:"head"`
+	// HeadSHA is the head commit the forge merged (novox/hq issue 703): a walk takes only a build a check of that
+	// head made. Empty from a forge module from before it, and then the walk takes no check's build.
+	HeadSHA  string `json:"head_sha,omitempty"`
 	Commit   string `json:"merge_commit_sha"`
 	CloneURL string `json:"clone_url"`
 	HTMLURL  string `json:"html_url"`
@@ -290,6 +300,14 @@ type Checked struct {
 	Trunk  string            `json:"trunk,omitempty"`
 	Beside map[string]string `json:"beside,omitempty"`
 	Took   string            `json:"took,omitempty"`
+	// Release is the release branch the check judged for (novox/hq ADR 0358 §4), JudgedBy the commit of the
+	// controller that judged its gate (twelve characters), and BesideAt the branch each repository beside it was
+	// read at, by directory: so a reader sees a release-branch judgement apart from a trunk one. Empty otherwise.
+	Release  string            `json:"release,omitempty"`
+	JudgedBy string            `json:"judged-by,omitempty"`
+	BesideAt map[string]string `json:"beside-at,omitempty"`
+	// Validator says which node-engine validator the judge of a release-branch check was built with (ADR 0358 §2).
+	Validator string `json:"validator,omitempty"`
 	// Built are the builds the check made for its merge, each with its reuse key and digests, or why not
 	// (novox/hq ADR 0350 §1): what the walk of the merge takes instead of building.
 	Built []CheckBuilt `json:"built,omitempty"`