Raise a process-form controller at genesis as the container it replaces (hq issue 223)

The controller's manifest now declares a Go bundle the host runs as a
process (novox/hq issue 213). Genesis cannot run that: the bundle is
fetched from the artifact store and compiled in a toolchain, and the mesh
makes both long after the controller. The builder, asked to build the
manifest at genesis, refuses for lack of the Go toolchain. So genesis
raises the controller as before, as a container, and the first push hands
it over to the process through `replaces` (issue 223, option b).

- Step 3 clones the controller at the commit with the carried builder's
  git and reads its manifest. In the image form (an older controller) it
  builds through the builder as before. In the process form it builds the
  repository's own Dockerfile and hands step 9 a manifest of its own
  shape: the process becomes a container with the id the process
  `replaces`, the image genesis built, host network, and every host path
  the process's env names mounted at that same path read-only. Secrets
  belong to the image's user (65534) until the process's account takes
  them over. `prepares` is dropped: the temporary controller from the
  same commit already migrated the stores, and a pinned image is
  nothing the controller can derive a step from.
- Steps 4 to 9 are unchanged: they take the manifest as they did.
- apply.ForTests lets the bootstrap's test apply a process.

The first composed declaration from the process manifest names
`mesh-controller.server`, which is what the host recorded for the genesis
container, so the first apply hands over and leaves one controller.

internal/apply/testing_dirs.go

@@ -0,0 +1,13 @@
+package apply
+
+// ForTests points where the host writes units and unpacks daemons at directories a test owns, and
+// waits nothing between its looks at a unit, until the returned function puts them back. For tests
+// in other packages that apply a process — the bootstrap's, which checks that what genesis raises is
+// what the controller's process takes over (novox/hq issue 223). Nothing outside a test calls it.
+func ForTests(units, daemons string) (restore func()) {
+	wasUnits, wasDaemons, wasSettle, wasHandover := unitDir, daemonRoot, serviceSettle, handoverSettle
+	unitDir, daemonRoot, serviceSettle, handoverSettle = units, daemons, 0, 0
+	return func() {
+		unitDir, daemonRoot, serviceSettle, handoverSettle = wasUnits, wasDaemons, wasSettle, wasHandover
+	}
+}