Ask build-agent for the build modules that write references, whatever the builder says (issue 1886, ADR 0522 §6)

They push and answer each reference, so a key they write themselves can never
carry their own delivery; until R4g build-agent delivers them as it does the
builder.

cmd/mesh-controller/plan_keys.go

@@ -32,7 +32,12 @@ func isBuildersOwn(module string) bool { return buildersOwn(module) }
 // repository's; and mesh-tools, the toolchain image build-agent's builds stand on. The builder writes no key of any of them,
 // and a walk waiting for one would hold its tier for ever. mesh-tools-go is not among them: it builds from a Dockerfile in
 // its own directory on a pinned base, and has its key from mesh-build-image.
-var buildAgentsOwn = map[string]bool{sdkdelivery.BuilderModule: true, builder.AgentModule: true, "mesh-tools": true}
+//
+// **And the parts that write references** (ADR 0522 §6, issue 1886): the build modules push and answer each reference,
+// and the builder writes it into the key, so none of them is ever taken from a key they write themselves. Until R4g
+// build-agent is the way they are delivered whatever the builder says.
+var buildAgentsOwn = map[string]bool{sdkdelivery.BuilderModule: true, builder.AgentModule: true, "mesh-tools": true,
+	"mesh-build-go": true, "mesh-build-node": true, "mesh-build-image": true}
 
 // buildersOwn is isBuildersOwn's rule: a variable only so a test of the asks left (their bus waits, their plan key) may
 // name modules of its own as build-agent's.