Send a merge's builds to every machine at once, with no first-machine gate (hq ADR 0360)

The operator chose the leanest rollout: no gate, no one machine first, failures loud and fixed forward.
A walk sends every rolled-out module to every machine running it in one step, built-by orders no tier,
and a walk ends on its machines' reports. The backlog walk sends every machine at once and passes each
on its applied report.

cmd/mesh-controller/lean_walk_test.go

@@ -0,0 +1,41 @@
+package main
+
+import (
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// novox/hq ADR 0360 §4, §5: a walk ends on its machines' reports — every machine sent has reported on its send,
+// or is silent past ApplySilentAfter — and names a failed or refused apply; it never waits for a health reading.
+func TestAWalkEndsOnItsMachinesReports(t *testing.T) {
+	now := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	sent := now.Add(-time.Minute)
+	long := now.Add(-inventory.ApplySilentAfter - time.Minute)
+	at := now.Add(-10 * time.Second)
+	p := inventory.Plan{Modules: map[string]*inventory.PlanModule{
+		"app": {Rest: map[string]inventory.SentDeclaration{
+			"ace":    {Digest: "d-ace", At: sent},
+			"novox":  {Digest: "d-novox", At: sent},
+			"shanks": {Digest: "d-shanks", At: sent},
+			"laptop": {Digest: "d-laptop", At: long},
+		}},
+		"proxy": {Rest: map[string]inventory.SentDeclaration{"ace": {Digest: "d-ace", At: sent}}},
+	}}
+	reports := []inventory.Reported{
+		{Node: "ace", Outcome: inventory.OutcomeApplied, At: &at, Declared: "d-ace"},
+		{Node: "novox", Outcome: inventory.OutcomeFailed, At: &at, Declared: "d-novox"},
+		{Node: "shanks", Outcome: inventory.OutcomeApplied, At: &at, Declared: "d-before"},
+	}
+	waiting, failed, silent := walkReports(p, reports, now)
+	if !slices.Equal(waiting, []string{"shanks"}) || !slices.Equal(failed, []string{"novox"}) ||
+		!slices.Equal(silent, []string{"laptop"}) {
+		t.Fatalf("waiting %v, failed %v, silent %v", waiting, failed, silent)
+	}
+	reports[2].Declared = "d-shanks"
+	if waiting, _, _ := walkReports(p, reports, now); len(waiting) != 0 {
+		t.Fatalf("the walk still waits once every machine reported: %v", waiting)
+	}
+}