Let an archive be an upstream release pinned by URL and sha256, mirrored by the build seat (hq issue 345, ADR 0316)

A mail client's release is about 80 MB per version, too large to keep in a
repository at every upgrade, and an add-on whose licence forbids copying it
to third parties may not be in a repository at all. An archive artifact may
now name url, sha256 and version (and file or within) instead of from: the
build seat fetches it once, refuses it when its digest is not the pin's and
names both, keeps it in its workspace under the digest (a vendor that serves
only its newest version cannot break a later build of the same pin), and
packs it like any archive, so a node gets the mesh's own archive by digest
and never asks the vendor. The build seat's image carries xz, which Go's
standard library does not read. The installation check takes the vendor's
address and version of such a pin for the world's, as a registry is an
image's.

internal/catalogue/installation.go

@@ -71,6 +71,10 @@ var hostname = regexp.MustCompile(
 		`(?:be|nl|de|fr|uk|eu|com|net|org|io|dev|app|cloud|site|online|me|co|ch|at|lu|` +
 		`internal|example|tld|test|invalid)`)
 
+// upstreamPin is where an artifact pinned by URL says where it is published and which release it is: the
+// vendor's address and the vendor's version, which name no installation (Artifact.URL).
+var upstreamPin = regexp.MustCompile(`^build\.artifacts\[[0-9]+\]\.(url|version)$`)
+
 // address is a dotted quad.
 var address = regexp.MustCompile(`(?:[0-9]{1,3}\.){3}[0-9]{1,3}`)
 
@@ -113,6 +117,11 @@ func InstallationProblems(m Manifest) []string {
 			"%s is named after %s, and a module is named for what it is, not for where it runs", m.Module, name))
 	}
 	walk(tree, "", nil, func(at string, value string, meant map[string]bool, isImage bool) {
+		// An archive pinned by URL names the vendor that publishes it, and the version it pins, which may
+		// have four dotted numbers (novox/hq ADR 0316): the world's, as a public registry is an image's.
+		if upstreamPin.MatchString(at) {
+			return
+		}
 		for _, name := range namesIn(value) {
 			if (isImage && worldsRegistries[strings.ToLower(name)]) || meant[name] {
 				continue