Apply through one queue, and order what is applied and reported (hq to-be 45 Phase 2)

A delivery and the five-minute reconcile were two paths that applied, ordered only by a lock, and
each order it allowed was met live (issues 257, 261, 267). Now both only enqueue: one worker takes
the newest declaration held when it starts, applies it once and makes one report, and reports leave
in the order they are made.

A declaration may carry the controller's lease epoch beside its sequence; one older than what this
node applied is refused before anything is touched, counted, logged and reported. A report carries
the declaration's epoch and sequence and the host's own report sequence, kept on disk so it goes on
increasing across restarts and self-updates. Without an epoch, today's behaviour stands.

validate/validate_test.go

@@ -12,6 +12,12 @@ func TestTheValidatorIsTheHosts(t *testing.T) {
 	if problems := Declaration([]byte(good)); problems != nil {
 		t.Fatalf("a declaration the host takes was refused: %v", problems)
 	}
+	// And one carrying the lease epoch and sequence the controller sends it under (novox/hq to-be 45
+	// §6): a controller validating with this package may send them.
+	ordered := `{"declaration": 1, "epoch": 57, "sequence": 3, "resources": [{"id": "d", "type": "directory", "path": "/var/lib/x", "mode": "0755"}]}`
+	if problems := Declaration([]byte(ordered)); problems != nil {
+		t.Fatalf("a declaration carrying its order was refused: %v", problems)
+	}
 	for _, bad := range []string{
 		`{"declaration": 1, "resources": []}`,
 		`{"declaration": 99, "resources": [{"id": "d", "type": "directory", "path": "/x"}]}`,