Let a planned maintenance window fail no apply (hq issue 291)

At 03:30 the store's collector held the registry still while the
node-engine's reconcile on that machine was fetching bundle blobs from
it: every archive failed 'connection refused' and the machine was held
until the next pass. Other machines can meet the same window.

A scheduled step now opens its window only once no apply is in flight
here (the apply lock is taken just to write the record, so a push still
never queues behind the window). An apply whose fetch the store does
not answer waits for a window open on its own machine to close, and
elsewhere retries with backoff within one bounded budget per apply,
well past the window's length; an answer such as 404 still fails at
once.

internal/apply/process.go

@@ -39,11 +39,11 @@ var daemonRoot = "/var/lib/mesh/daemons"
 var unitDir = "/etc/systemd/system"
 
 func applyProcess(ctx context.Context, r *declaration.Process, run Runner,
-	changed map[string]bool, previous store.Applied) (Outcome, error) {
+	changed map[string]bool, previous store.Applied, away *storeAway) (Outcome, error) {
 	out := begin(r)
 	out.Action = "unchanged"
 
-	body, err := fetch(ctx, r.Source)
+	body, err := fetchMinding(ctx, r.Source, away)
 	if err != nil {
 		return out, err
 	}