Ask only once the bus enforces the controller's own grant, judged for real and failing closed (review of hq issue 353)

change held asking back, a list sent was taken for a list the bus enforces, a plan that could not be
worked out read as not behind, and no test held the real judgement. Now the asker asks only when the
composition grants the controller itself to publish its ask, and the bus's own module says that grant
is in force on the running server (nats_user_can's in_force, mesh-catalog); each fact not known is not
held, said with why. brokerBehind takes a list nobody could compose as behind.

cmd/mesh-controller/push.go

@@ -1106,20 +1106,29 @@ func brokerBehind(ctx context.Context, open *stores, names []string) (string, bo
 			return h.Node, false, nil
 		}
 	}
+	// **What cannot be worked out is behind** (the review of hq issue 353). The list it would be sent cannot be
+	// composed, so whether it carries the grants a send relies on is not known; it is taken as behind, so a push
+	// sends that machine first and says why it cannot (`plan` says it too), and a rollout that needs the list
+	// refuses rather than sending code whose grants the bus may not hold. It said "not behind" until then: a
+	// send went ahead as if the bus held a list nobody could compose.
+	list, composeErr := "", error(nil)
 	plan, _, err := planFor(ctx, open, h.Node)
 	if err != nil {
-		// It cannot be worked out: sending it would refuse the whole send, and `plan` says why.
-		return h.Node, false, nil
-	}
-	list, _, err := busUserList(ctx, inv, plan.Modules)
-	if err != nil {
-		return h.Node, false, nil
+		composeErr = err
+	} else if list, _, err = busUserList(ctx, inv, plan.Modules); err != nil {
+		composeErr = err
 	}
 	sent, err := inv.SentBusUsers(ctx, h.Node)
 	if err != nil {
 		return "", false, err
 	}
-	return h.Node, userListBehind(list, sent), nil
+	return h.Node, listBehind(list, composeErr, sent), nil
+}
+
+// listBehind is whether the bus's machine is behind: the list composed now is not the one last sent, or it
+// could not be composed at all — not known is behind, never "not behind".
+func listBehind(list string, composeErr error, sentDigest string) bool {
+	return composeErr != nil || userListBehind(list, sentDigest)
 }
 
 // userListBehind is whether the user list composed now is not the one last sent, by its digest. An