Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

A secrets object with one local name delivered no file. Two requirements could share
a local name. secret recover and the export could not tell two locals apart. The
recipe check missed continued lines and read heredoc bodies as bases. repo:tag@digest
kept the tag in the repository. ask now publishes mandatory, so a tool nothing serves
is said at once rather than after the wait.

internal/catalogue/declaration.go

@@ -651,7 +651,10 @@ func (r Resolution) contributions(settings SettingsBy, grants []Grant,
 		if sorted[i].Consumer != sorted[j].Consumer {
 			return sorted[i].Consumer < sorted[j].Consumer
 		}
-		return sorted[i].From < sorted[j].From
+		if sorted[i].From != sorted[j].From {
+			return sorted[i].From < sorted[j].From
+		}
+		return sorted[i].Local < sorted[j].Local
 	})
 	// A consumer already carried by the grants loop, keyed (provision, module). When provider and
 	// consumer are co-located, `grantsFor` enumerates the same-node consumer too, so without this the
@@ -788,6 +791,8 @@ type Kept struct {
 	Sealed string    `json:"sealed"`
 	Key    string    `json:"key"`
 	MadeAt time.Time `json:"made-at"`
+	// Local is the credential's name inside the consumer where it holds several (ADR 0094).
+	Local string `json:"local,omitempty"`
 }
 
 // KeptExport is what a person keeps beside the operator key, and what a vault keeps on its disk: