apply: reload units only for a unit file actually written or removed (issue 1126)

A skipped or held file comes back on every apply; counting it would reload the
service manager on every apply of a node with a gated or held module. The same
allowlist as MovesRoot: created, updated, corrected, removed.

internal/apply/apply.go

@@ -2018,11 +2018,14 @@ var UnitDirs = []string{"/etc/systemd/system", "/run/systemd/system", "/usr/loca
 // or "" when it moved none.
 func unitFileMoved(outcomes []Outcome) string {
 	for _, o := range outcomes {
-		if declaration.Type(o.Type) != declaration.TypeFile || !moved(o) {
+		// Only what changed the file on disk, as MovesRoot reads it: skipped, held, kept, forgotten and waiting come
+		// back on every apply and change nothing.
+		if declaration.Type(o.Type) != declaration.TypeFile {
 			continue
 		}
 		switch o.Action {
-		case "kept", "forgotten", "waiting":
+		case "created", "updated", "corrected", "removed":
+		default:
 			continue
 		}
 		at := filepath.Clean(o.Target)

internal/apply/apply_test.go

@@ -1300,6 +1300,13 @@ func TestAServiceIsRestartedWhenWhatItReflectsChanges(t *testing.T) {
 				t.Errorf("%s: %d reloads, want %d; commands were %v", row.name, reloads, row.reloads, commands)
 			}
 		}
+		// A drop-in whose module is skipped behind its step, or held as found, comes back so on every apply: it moved
+		// nothing, and reloads nothing.
+		for _, action := range []string{"skipped", "held"} {
+			if at := unitFileMoved([]Outcome{{ID: "bound", Type: "file", Target: dropIn, Action: action}}); at != "" {
+				t.Errorf("a drop-in %s reloads the service manager (%s)", action, at)
+			}
+		}
 	}
 }