delivery: the indexer's packages state and the imports a build reports, so only the indexer computes a fingerprint over what a module imports (ADR 0593 §2)

Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL

go/delivery/source.go

@@ -467,6 +467,11 @@ type KeptInputs2 struct {
 	// fingerprint takes the latest published version of each (Module.Packages). Absent for none, and in a value written
 	// before.
 	Packages []string `json:"packages,omitempty"`
+	// Imports are the mesh packages (import paths) the module's programs import, their tests left out, as the module's
+	// last trunk build reported them at its end (BuildLogEntry.Imports; novox/hq ADR 0593 §2), sorted and each once:
+	// the fingerprint takes each one's content digest (PublishedPackages) instead of Packages' versions. Absent for a
+	// module with no reported import set, which keeps the version line, and in a value written before.
+	Imports []string `json:"imports,omitempty"`
 }
 
 // checkPathObjects refuses a named path that is not clean and relative to the module's directory, or names no object.
@@ -549,6 +554,9 @@ func (m Module) check() error {
 		}
 	}
 	if m.Inputs2 != nil {
+		if err := CheckImports(m.Inputs2.Imports); err != nil {
+			return err
+		}
 		if err := checkNamed(m.Inputs2.Tree, m.Manifest, m.Inputs2.Paths, "the module's kept inputs"); err != nil {
 			return err
 		}