Refuse the grants step when its send would change more than the bus's user list (review of #230)

Kept builds are not the whole declaration: a new assignment, settings or
a provision's logins went out as the mesh holds them now. The step now
compares what it would send with the last send's summary and fails, said,
when anything but the user list differs; ungatedIn reads the kept builds
instead of passing the step unread.

cmd/mesh-controller/grants_step_test.go

@@ -32,8 +32,9 @@ type aSend struct {
 func sendsRecorded(t *testing.T, holder string, behind bool, refuse error) *[]aSend {
 	t.Helper()
 	var sends []aSend
-	wasSend, wasBehind := sendRollout, brokerBehindOf
-	t.Cleanup(func() { sendRollout, brokerBehindOf = wasSend, wasBehind })
+	wasSend, wasBehind, wasOnly := sendRollout, brokerBehindOf, grantsOnlyOf
+	t.Cleanup(func() { sendRollout, brokerBehindOf, grantsOnlyOf = wasSend, wasBehind, wasOnly })
+	grantsOnlyOf = func(context.Context, *stores, string) (string, error) { return "", nil }
 	brokerBehindOf = func(_ context.Context, _ *stores, names []string) (string, bool, error) {
 		if slices.Contains(names, holder) {
 			return holder, false, nil
@@ -122,11 +123,21 @@ func TestAGrantsStepThatFailsIsSaidAndTheSendGoesOn(t *testing.T) {
 	}
 }
 
-// The grants step moves no build, so no gate's refusal holds it back: it is never read for moves.
-func TestTheGrantsStepIsNotHeldForTheBuildsItKeeps(t *testing.T) {
-	names, err := ungatedIn(keepingEveryBuild(t.Context()), nil, []string{"novox"}, "")
-	if err != nil || strings.Join(names, ",") != "novox" {
-		t.Errorf("the grants step's send reads %v, %v", names, err)
+// A step whose send would change more than the user list is not sent: it fails, said, and the walk goes on.
+func TestAGrantsStepThatWouldCarryMoreIsNotSent(t *testing.T) {
+	sends := sendsRecorded(t, "novox", true, nil)
+	grantsOnlyOf = func(context.Context, *stores, string) (string, error) {
+		return "its send would change more than the bus's user list: -postgres.login-n8n", nil
+	}
+	sent, grants, err := sendJudged(t.Context(), nil, "ace")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(*sends) != 1 || (*sends)[0].keepsAll || strings.Join(sent, ",") != "ace" {
+		t.Errorf("the walk made %+v, want ace's judged send alone", *sends)
+	}
+	if grants == nil || grants.At != nil || !strings.Contains(grants.Failed, "-postgres.login-n8n") {
+		t.Fatalf("the gate keeps %+v", grants)
 	}
 }