Gate a release plan's first machine and roll a failed build back there (hq ADR 0236)

A build that reported applied was sent everywhere; one that then did nothing, served
no tools or broke its machine's word reached every machine. Now the first machine is
judged by the component's health (the core's definitions, as doctor probes H-*, or a
module's own) three times over two minutes within ten; a failing gate puts the previous
build back there once, marks the build, and says it as a condition and an event.
Upgrades roll out by default; the bus is a planned step; a module deleted at its
source is not built (the public-acme plan failure).

internal/inventory/migrations/0073-a-build-rolls-out-gated-and-rolls-back.sql

@@ -0,0 +1,67 @@
+-- A module's build rolls out one machine first, judged at a gate, and rolls back there when the gate
+-- fails (novox/hq ADR 0235, to-be 45 §8, Phase 4).
+--
+-- 1. The upgrade policy becomes a person's choice over the module's own word. Until now every module
+--    held a policy here, 'record' unless a person had said 'roll-out', and nothing distinguished a
+--    'record' somebody chose from the default it always was. From here a null policy is no choice: the
+--    module's manifest decides (its `upgrade`, its data, whether it is the bus), and its default is to
+--    roll out. A 'roll-out' a person chose is kept as their choice. A 'record' is the old default and
+--    becomes no choice — ADR 0235 decides it, and lists every module's resulting policy; a person who
+--    wants one held again says so with `upgrade <module> record --why`, which is kept with its why.
+alter table module alter column upgrade drop not null;
+alter table module alter column upgrade drop default;
+alter table module drop constraint if exists module_upgrade_check;
+alter table module add constraint module_upgrade_chosen check (upgrade is null or upgrade in ('record', 'roll-out'));
+update module set upgrade = null where upgrade = 'record';
+-- Why the person chose it, and who: said back by `upgrade`, so a held module says why it is held.
+alter table module add column upgrade_why text not null default '';
+alter table module add column upgrade_by  text not null default '';
+
+-- 2. The gate's verdict on each build a plan rolled out, one row per build: passed on its first machine,
+--    or failed there and rolled back. **A build that failed its gate is marked, and is never sent again
+--    automatically**: registration refuses it, and the rollback is attempted once per build — the row is
+--    written before the rollback's send, so a controller replaced in between does not send it twice.
+create table build_gate (
+    build        text        primary key,
+    module       text        not null,
+    -- The commit the build was made from, and the one the module was put back to.
+    commit_hash  text        not null default '',
+    previous     text        not null default '',
+    plan         text        not null default '',
+    -- The machines it was judged on: the first machine, and the bus holder when it went with it.
+    machines     text[]      not null default '{}',
+    -- 'passed', or 'failed'; and for a failed one how the rollback went: 'rolling-back', 'rolled-back',
+    -- or 'not-rolled-back' (no previous build to put back, or the send refused), said in `why`.
+    verdict      text        not null check (verdict in ('passed', 'failed')),
+    rollback     text        not null default '' check (rollback in ('', 'rolling-back', 'rolled-back', 'not-rolled-back')),
+    why          text        not null default '',
+    -- The core component it is, when it is one: mesh-controller, mesh-host, node-tools.
+    component    text        not null default '',
+    judging_from timestamptz,
+    judged_at    timestamptz not null default now(),
+    epoch        bigint
+);
+create index build_gate_module on build_gate (module, judged_at desc);
+
+-- 3. The bus's planned step (to-be 45 §8): a bus upgrade is never rolled out; a person starts it, with
+--    why, after its streams are snapshotted, and it is checked after. One row per step; the open one is
+--    the step running, which the self-check says as `bus-maintenance` until the bus is healthy again or
+--    the step's bound passes and it is said failed, with its snapshot as the way back.
+create table bus_step (
+    id           bigserial   primary key,
+    module       text        not null,
+    machines     text[]      not null default '{}',
+    from_build   text        not null default '',
+    to_build     text        not null default '',
+    -- Where the streams' snapshot is: taken by the mesh, or one a person says they took.
+    snapshot     text        not null,
+    -- Whether the new version can be reverted by putting the old one back, as the person said it.
+    reversible   boolean     not null,
+    by_whom      text        not null default '',
+    why          text        not null,
+    started      timestamptz not null default now(),
+    ended        timestamptz,
+    -- '', then 'done' or 'failed', with what was found.
+    outcome      text        not null default '' check (outcome in ('', 'done', 'failed')),
+    found        text        not null default ''
+);