Judge every pull request against the mesh that runs, before it merges (hq ADR 0237, to-be 45 §9)

Every check the mesh had ran after a merge, on a machine: a manifest the node-engine refused
(236), an identity a real machine's name made too long (263). merge-gate raises the mesh as the
facts snapshot says it is and the mesh with the change, each in a throwaway store through the
controller's own records, composes every machine twice and validates it with the node-engine's
validator, and fails what the change breaks, naming the machine's roles and the module - plus a
manifest the judging controller cannot read, a consumer left out of its grant, a module removed
while a machine runs it, a new module the node-engine would refuse; it warns on a wide rebuild.

The forge's new head of a pull request becomes a check the controller asks of the build seat:
the head and, beside it, the controller the mesh runs, the catalogue, the host and the lab; a
throwaway store and bus of the versions the mesh runs; the repository's merge-check.sh in the
mesh's Go toolchain with no container runtime socket; then mesh-lab's replays. The verdict is
said as checked, an error never a pass, and nothing is recorded or registered.

internal/link/receive.go

@@ -39,6 +39,9 @@ const (
 	// KindProvisioner is a provider saying a consumer has failed for minutes, or recovered
 	// (novox/hq ADR 0224).
 	KindProvisioner = "provisioner"
+	// KindPullUpdated is the forge announcing a pull request's new head: checked before it merges
+	// (novox/hq to-be 45 §9).
+	KindPullUpdated = "pull-updated"
 )
 
 // Control is one thing a node or a module said, as the controller must act on it.