Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

A build that reported applied was sent everywhere; one that then did nothing, served
no tools or broke its machine's word reached every machine. Now the first machine is
judged by the component's health (the core's definitions, as doctor probes H-*, or a
module's own) three times over two minutes within ten; a failing gate puts the previous
build back there once, marks the build, and says it as a condition and an event.
Upgrades roll out by default; the bus is a planned step; a module deleted at its
source is not built (the public-acme plan failure).

cmd/mesh-controller/push.go

@@ -466,6 +466,27 @@ func pushCommand(ctx context.Context, args []string) error {
 			which, len(asked), strings.Join(asked, ", "))
 	}
 
+	// **The bus is replaced only as a planned step** (novox/hq ADR 0235, to-be 45 §8): a machine whose bus
+	// would move is not sent by a push — named, it is refused; otherwise it is left and said.
+	busKept, err := busHeld(ctx, inv, asked)
+	if err != nil {
+		return err
+	}
+	if len(busKept) > 0 {
+		if len(args) == 1 {
+			return fmt.Errorf("%s. Nothing was sent", busKept[args[0]])
+		}
+		var kept []string
+		for _, n := range asked {
+			if why, h := busKept[n]; h {
+				fmt.Printf("  %s is left: %s\n", n, why)
+				continue
+			}
+			kept = append(kept, n)
+		}
+		asked = kept
+	}
+
 	// **The machine holding the bus first** (novox/hq issue 249): its declaration carries the bus's
 	// user list, and a module's new grants are refused by the bus until that list says them. Among
 	// the machines asked it goes first; not among them and behind, it is added — a named push whose