ADR 0266: on the control node agents run under an account of their own

The operator chose this remedy for ADR 0259 section 8: an agent there could
become root through the operator account's sudo and docker group, and read the
tool runner's credential. Record the node fact, the node-engine's judgement
the self-check reads, the guard, and how a session starts; issue 333 holds
the measured symptom and to-be 36 the design.

00-META/glossary.md

@@ -214,6 +214,10 @@ and Health and repair. **Decided by** ADR 0100, 0126, 0176, 0181, 0207, 0221, 02
   against this account's home and owned by it
   ([ADR 0181](../02-DECISIONS/0181-the-operator-account-is-a-node-fact-and-a-home-is-a-placement-root.md)).
   Not a name a manifest carries.
+- **agent account** — the login every coding agent on a node runs as, when the node names one of its own;
+  stated on the node record at the controller's terminal, never by a verb or a setting. Empty means agents
+  run as the operator account. It cannot become root without a person, and the node-engine judges that on
+  every look ([ADR 0266](../02-DECISIONS/0266-on-the-control-node-agents-run-under-an-account-of-their-own-that-cannot-become-root-without-a-person.md)).
 - **account group** — a group of the machine's group database that a module puts an account in, by
   declaring the account with that group and nothing else of it. Several modules may each add one to the
   same account; the mesh takes back only an account group it added