Status says when each machine last reported, beside when it was sent

"Not waiting" says the declaration is current, not that the machine
finished applying it: the sent digest is recorded at send. So a test
that pushed, saw waiting clear, and asked the machine what it was
running found containers that did not exist yet — the certificate fix
made compositions stable, and the settling that used to fail first had
been hiding the gap behind it.

The mesh already held the missing half: every machine's last report,
with its time. It just was not in the JSON. `reported` now sets each
machine's last word beside when the current declaration went to it, and
"has it caught up" becomes a comparison of two timestamps the mesh
recorded itself — a report newer than the send means the machine acted
on what was sent; older means it is still working, which waiting alone
cannot distinguish.

cmd/mesh-control/status.go

@@ -54,7 +54,8 @@ func statusCommand(ctx context.Context, args []string) error {
 	behind, sources := asked.behind, asked.sources
 
 	if *asJSON {
-		body, err := statusAsJSON(wrong, nodes, quiet, behind, sources, asked.waiting)
+		body, err := statusAsJSON(wrong, nodes, quiet, behind, sources, asked.waiting,
+			asked.reported)
 		if err != nil {
 			return err
 		}
@@ -207,6 +208,10 @@ func theThreeQuestions(ctx context.Context, open *stores) (answers, error) {
 	if err != nil {
 		return answers{}, err
 	}
+	out.reported, err = inv.LastReports(ctx)
+	if err != nil {
+		return answers{}, err
+	}
 	out.sources = map[string]inventory.Source{}
 	for module := range out.behind {
 		from, err := inv.SourceOf(ctx, module)