Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

A secrets object with one local name delivered no file. Two requirements could share
a local name. secret recover and the export could not tell two locals apart. The
recipe check missed continued lines and read heredoc bodies as bases. repo:tag@digest
kept the tag in the repository. ask now publishes mandatory, so a tool nothing serves
is said at once rather than after the wait.

internal/inventory/secrets_test.go

@@ -6,6 +6,7 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/secrets"
 	"strings"
 	"testing"
 
@@ -673,3 +674,44 @@ func TestTwoLocalNamesAreTwoCredentials(t *testing.T) {
 		t.Fatalf("the provider is told two credentials to create: %+v", from)
 	}
 }
+
+// The operator can recover either of two local names apart (review C3).
+func TestTheOperatorRecoversEachLocalNameApart(t *testing.T) {
+	inv, ctx := twoNodesWithKeys(t)
+	pub, _, err := secrets.Keypair()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.SetOperatorKey(ctx, pub); err != nil {
+		t.Fatal(err)
+	}
+	for _, local := range []string{"root-key", "root-pass"} {
+		if _, err := inv.SecretFor(ctx, "secret", "consumer", "gitea", "provider", local); err != nil {
+			t.Fatal(err)
+		}
+	}
+	key, err := inv.KeptSecret(ctx, "consumer", "gitea", "secret", "provider", "root-key")
+	if err != nil {
+		t.Fatal(err)
+	}
+	pass, err := inv.KeptSecret(ctx, "consumer", "gitea", "secret", "provider", "root-pass")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if key.Local != "root-key" || pass.Local != "root-pass" || key.Kind != "pair" {
+		t.Fatalf("recovery does not tell the two apart: %+v %+v", key, pass)
+	}
+	kept, _, _, err := inv.KeptForOperator(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var locals []string
+	for _, k := range kept {
+		if k.Kind == "pair" {
+			locals = append(locals, k.Local)
+		}
+	}
+	if strings.Join(locals, ",") != "root-key,root-pass" {
+		t.Fatalf("the export does not name the local names: %v", kept)
+	}
+}