Wait until the node applied the genesis document before the sdk step asks for a build (hq issue 615)

The packages step sealed the build agent its genesis document and pushed, and the push returned as soon
as it was sent. The sdk step then asked for the SDK's build at once, and the agent reads the document
from the file the node writes when it applies that push: one genesis found it in time, the next was
refused for having neither a binding nor the document. That one push now waits until the node reports
it applied it (push --wait); every other push still returns on sending.

internal/bootstrap/module.go

@@ -137,7 +137,26 @@ func registerAndAssign(ctx context.Context, o Options, control controlPlane, mod
 // should hold, seals every secret in them and publishes them, and on a first node that is the
 // slowest thing the mesh does.
 func pushNode(ctx context.Context, o Options, control controlPlane, say func(string)) (string, error) {
-	said, err := control.within(o.Wait).tell(ctx, "push", o.Node)
+	return pushing(ctx, o, control, false, say)
+}
+
+// pushNodeApplied is pushNode that returns only once the node reports it applied exactly what it was
+// sent (`push <node> --wait`, novox/hq ADR 0010): for a push whose content the very next step reads
+// on the machine. A plain push returns as soon as the declaration is sent, and the node applies it a
+// moment later (issue 615).
+func pushNodeApplied(ctx context.Context, o Options, control controlPlane, say func(string)) (string, error) {
+	return pushing(ctx, o, control, true, say)
+}
+
+func pushing(ctx context.Context, o Options, control controlPlane, applied bool, say func(string)) (string, error) {
+	args := []string{"push", o.Node}
+	patience := o.Wait
+	if applied {
+		args = append(args, "--wait", o.Wait.String())
+		// The controller's own wait, and time to compose and send before it starts.
+		patience = 2 * o.Wait
+	}
+	said, err := control.within(patience).tell(ctx, args...)
 	if err != nil {
 		return "", fmt.Errorf(
 			"%w\n\nWhat was registered and assigned is registered and assigned, and this node has "+
@@ -145,7 +164,11 @@ func pushNode(ctx context.Context, o Options, control controlPlane, say func(str
 				"at all. Fix what it named and run this installer again: it will find the module "+
 				"already registered and try the push again", err)
 	}
-	say("  pushed            " + o.Node)
+	if applied {
+		say("  pushed            " + o.Node + ", and it applied it")
+	} else {
+		say("  pushed            " + o.Node)
+	}
 	// **Every push may carry a new bus user, and until the adoption the bus hears of it only from here**
 	// (novox/hq issue 608, ADR 0331 §5, ADR 0333 §4). A module's account is minted into the mesh's
 	// records and sealed to this node with the push; the bus reads its user list from a file, and until