Record the bases a build copies, keep them by the builds that stood on them, and copy each image once

A copied base was named only in what a build stood on, and nowhere when the build failed,
so the store's sweep could never let one go (hq issue 321). One repository per upstream
image stops each module asking the public registry for the same image again, and letting
an index go now takes its own platform manifests, which otherwise kept every byte. A
person can record the copies no record names through the new mirrors verb (hq ADR 0257).

The forge test fix is the same commit as on feat/plain-notifications: main fails without it.

cmd/mesh-controller/collect.go

@@ -76,6 +76,20 @@ func sweep(ctx context.Context, inv *inventory.Inventory, store artifacts.Store,
 	// as builds come, and is two HEADs each once done. A kept archive that could not be held stops
 	// the sweep before it deletes anything: "everything kept is held" is the precondition the
 	// collector's safety rests on, and a store refusing a hold would refuse the deletes too.
+	// **An index goes with its platform manifests, and a kept index keeps its own** (novox/hq ADR
+	// 0257): which of a repository's platform manifests a kept index names is read from the store
+	// before anything there is let go of. A keep set that cannot be read stops the sweep before it
+	// deletes anything, as a kept archive that cannot be held does.
+	if store.Spare == nil && inv != nil {
+		images, err := inv.KeptImages(ctx)
+		if err != nil {
+			r.Stopped = fmt.Sprintf("the images the mesh keeps could not be read, so nothing was let go: %v", err)
+			r.Left = len(references)
+			return r
+		}
+		store.Spare = store.SpareKeptIndexes(images)
+	}
+
 	wrote, missing, err := holdKept(within, store, kept)
 	r.HoldersWritten, r.Missing = wrote, missing
 	if err != nil {