Keep builds on the bus under their module, so no lookup reads the bucket whole (issue 1121, ADR 0427)

Milestone 5 moved 8,599 build records onto the bus under bare build ids, each
carrying its module's whole manifest. Every build lookup then read the whole
bucket, and a delivery plan's send did that per module per machine while it
held the plans and the machine's declaration: the send of build-agent never
finished, and every other act and the status waited behind it.

Builds now live under <module>.build.<id> (requests under req.<id>, id.<id>
names a build's module), with pointer keys newest, worked, held,
commit.<sha> and source.<reuse key> that move only to a newer build and are
read as hints, repaired when wrong. Manifests are kept once in the same
bucket under manifest.sha256-<hex>, so no grant the running bus lacks is
needed. The old keys are laid out once at start, idempotently, and left
unread. The calls a plan look makes on the silent clocks while it holds the
plans are bounded, since the vendored kv.Keys ignores its context.

internal/inventory/chain.go

@@ -89,29 +89,19 @@ func (i *Inventory) attached() *chain.Chain {
 // ChainReads says whether a kind of the chain is read from its bucket: chain_moved names it. It answers the chain to read
 // through, and ErrNoChain when the kind is moved and none is attached.
 func (i *Inventory) ChainReads(ctx context.Context, kind string) (*chain.Chain, bool, error) {
-	i.moved.mu.Lock()
-	known := i.moved.kind[kind]
-	i.moved.mu.Unlock()
-	if !known {
-		var moved bool
-		err := i.store.Pool().QueryRow(ctx, `select counts ? $1 from chain_moved`, kind).Scan(&moved)
-		var pgErr *pgconn.PgError
-		if errors.Is(err, pgx.ErrNoRows) || (errors.As(err, &pgErr) && pgErr.Code == "42P01") {
-			// No row, or a store older than the migration that makes the table: nothing moved.
-			return nil, false, nil
-		}
+	moved, err := i.kindMoved(ctx, kind)
+	if err != nil || !moved {
+		return nil, false, err
+	}
+	if kind == KindBuilds {
+		// **The builds are read under their modules** (issue 1121): until the layout is made, a read would find nothing.
+		laid, err := i.kindMoved(ctx, KindBuildsLayout)
 		if err != nil {
-			return nil, false, fmt.Errorf("whether %s moved to the bus cannot be read: %w", kind, err)
+			return nil, false, err
 		}
-		if !moved {
-			return nil, false, nil
+		if !laid {
+			return nil, false, fmt.Errorf("%w: the builds are not laid out under their modules yet; the move at the controller's start does it", ErrNoChain)
 		}
-		i.moved.mu.Lock()
-		if i.moved.kind == nil {
-			i.moved.kind = map[string]bool{}
-		}
-		i.moved.kind[kind] = true
-		i.moved.mu.Unlock()
 	}
 	i.moved.mu.Lock()
 	defer i.moved.mu.Unlock()
@@ -128,6 +118,36 @@ func (i *Inventory) ChainReads(ctx context.Context, kind string) (*chain.Chain,
 	return i.chain, true, nil
 }
 
+// kindMoved is whether chain_moved names a kind; once it does, always, so the store is asked until it is true.
+func (i *Inventory) kindMoved(ctx context.Context, kind string) (bool, error) {
+	i.moved.mu.Lock()
+	known := i.moved.kind[kind]
+	i.moved.mu.Unlock()
+	if known {
+		return true, nil
+	}
+	var moved bool
+	err := i.store.Pool().QueryRow(ctx, `select counts ? $1 from chain_moved`, kind).Scan(&moved)
+	var pgErr *pgconn.PgError
+	if errors.Is(err, pgx.ErrNoRows) || (errors.As(err, &pgErr) && pgErr.Code == "42P01") {
+		// No row, or a store older than the migration that makes the table: nothing moved.
+		return false, nil
+	}
+	if err != nil {
+		return false, fmt.Errorf("whether %s moved to the bus cannot be read: %w", kind, err)
+	}
+	if !moved {
+		return false, nil
+	}
+	i.moved.mu.Lock()
+	if i.moved.kind == nil {
+		i.moved.kind = map[string]bool{}
+	}
+	i.moved.kind[kind] = true
+	i.moved.mu.Unlock()
+	return true, nil
+}
+
 // ChainMoved is, per kind moved, how many records the move wrote; empty before any is.
 func (i *Inventory) ChainMoved(ctx context.Context) (map[string]int, error) {
 	var counts map[string]int