Ask only once the bus enforces the controller's own grant, judged for real and failing closed (review of hq issue 353)

change held asking back, a list sent was taken for a list the bus enforces, a plan that could not be
worked out read as not behind, and no test held the real judgement. Now the asker asks only when the
composition grants the controller itself to publish its ask, and the bus's own module says that grant
is in force on the running server (nats_user_can's in_force, mesh-catalog); each fact not known is not
held, said with why. brokerBehind takes a list nobody could compose as behind.

cmd/mesh-controller/delivery_order_test.go

@@ -119,6 +119,13 @@ func TestTheBusMachineIsBehindByItsUserListAlone(t *testing.T) {
 	if userListBehind("", "") {
 		t.Fatal("a machine sent no list reads as behind")
 	}
+	// A list that could not be composed is behind: not known is never "not behind" (the review of hq issue 353).
+	if !listBehind("", errors.New("the plan cannot be worked out"), digestOf([]byte(list))) {
+		t.Fatal("a list nobody could compose reads as current")
+	}
+	if listBehind(list, nil, digestOf([]byte(list))) || !listBehind(list, nil, "") {
+		t.Fatal("listBehind does not read the digest as userListBehind does")
+	}
 }
 
 // The machine holding the bus goes first: its declaration carries the user list the new grants are