Read every runtime's data root, keep when a directory was found, and key a hand-over to its resource

The review of #64 asked for containerd's tree, dockerd's --data-root from its
unit and drop-ins, and podman's graphroot to be refused like docker's own
(hq issue 339); and the controller now tells a directory a send found from
one found before it, which needs the time it was first found kept across
applies instead of the time of the last apply. A hand-over now names the
resource it was for, so it lapses if another declaration points at the path.

cmd/mesh-host/found.go

@@ -40,7 +40,7 @@ func handedOverFrom(statePath string) {
 		}
 		out := map[string]bool{}
 		for _, h := range all {
-			out[filepath.Clean(h.Path)] = true
+			out[apply.HandOverKey(h.ID, h.Path)] = true
 		}
 		return out
 	}
@@ -83,7 +83,7 @@ func withFoundDirectories(h *link.Health, found []store.Applied) *link.Health {
 			Reason: fmt.Sprintf("%s owned by %s, mode %s, as found; %s was declared and not given it — "+
 				"`mesh-host hand-over` at the machine hands it to the mesh", link.ReasonUsedAsFound, owner, mode,
 				declared),
-			Since: r.AppliedAt.UTC()})
+			Since: foundSince(r).UTC()})
 	}
 	return h
 }
@@ -121,7 +121,7 @@ func handOverCommand(opts options) error {
 		if u, err := user.Current(); err == nil {
 			by = u.Username
 		}
-		if err := store.AddHandedOver(opts.state, store.HandOver{Path: path, At: time.Now().UTC(), By: by}); err != nil {
+		if err := store.AddHandedOver(opts.state, store.HandOver{ID: r.ID, Path: path, At: time.Now().UTC(), By: by}); err != nil {
 			return err
 		}
 		fmt.Fprintf(opts.out, "%s (%s) is handed to the mesh: the next apply gives it %s, and it is the mesh's from "+
@@ -132,6 +132,15 @@ func handOverCommand(opts options) error {
 		"engine applied); nothing was handed over")
 }
 
+// foundSince is when a directory was first found as it is: kept across applies, so the controller can tell one
+// a send found from one found before it. A record from before that was kept says when it was last applied.
+func foundSince(r store.Applied) time.Time {
+	if !r.FoundAt.IsZero() {
+		return r.FoundAt
+	}
+	return r.AppliedAt
+}
+
 func orUnsaid(s string) string {
 	if s == "" {
 		return "the declared owner and mode"

cmd/mesh-host/found_test.go

@@ -56,7 +56,7 @@ func TestHandOverRecordsOnlyAFoundDirectory(t *testing.T) {
 		t.Fatalf("recorded: %+v %v", all, err)
 	}
 	handedOverFrom(statePath)
-	if !apply.HandedOver()[found] {
+	if !apply.HandedOver()[apply.HandOverKey("notes.data", found)] {
 		t.Fatal("the apply does not see the hand-over")
 	}
 	if !strings.Contains(out.String(), "root, mode 755") {