Register a module only from the repository the catalogue builds it from

An agent could make a repository of its own, or fork one the mesh builds
from, commit a module.json naming sudo or mesh-host, and ask the build verb
for it: the outcome was registered under that name, and the next push made
whoever wrote it root on every node (novox/hq ADR 0266 §7, the review of
2026-10-09). The trunk rule checked the trunk of the repository built, which
was the agent's.

The take-in, which every outcome reaches whichever verb asked it, now
registers a module only from its registered repository, and a new module only
from a repository the catalogue already builds from (a merge adding one);
anything else only when the build request was kept as asked at the
controller's terminal (migration 0084). Through a verb, a build of a
repository the catalogue builds nothing from is not asked at all.

internal/inventory/migrations/0084-a-build-asked-at-the-terminal-says-so.sql

@@ -0,0 +1,11 @@
+-- A build asked at the controller's terminal says so (novox/hq ADR 0266).
+--
+-- A build's outcome registers its module, and a module is what the next push sends: a module named `sudo`
+-- built from a repository an agent made would grant whoever wrote it root on every node it is assigned.
+-- So an outcome may register a module only from the repository the catalogue already builds it from — or,
+-- for a module new to the catalogue, from a repository the catalogue already builds another module from.
+-- Anything else — a module moved to another repository, a new module from a new repository — is the
+-- operator's, at the controller's terminal. This column is how the take-in tells: true only for a build
+-- request kept by a `build` or `replay --register` run at the terminal, never through a verb (whoever may
+-- call a verb includes agents). False for every request kept before this column existed.
+alter table build_request add column at_terminal boolean not null default false;