Tell the operator what the mesh finds wrong, and watch the watcher (hq to-be 45 phase 1)

The mesh noticed 48 core failures in six days and told nobody (ADR 0227).
messenger holds the operator-channel seat: it consumes the controller's
condition events and sends them to Telegram and the desktop notifier,
deduplicated by key, reminded once, edited on clear, capped at 20 an hour
with the rest folded, and refusing anything carrying an address, a path or
a secret. mesh-watcher, on a machine other than the control node, sends to
Telegram directly when the self-check heartbeat or the bus goes silent.

modules/mesh-watcher/module.json

@@ -0,0 +1,56 @@
+{
+  "module": "mesh-watcher",
+  "version": "1",
+  "slug": "watch",
+  "consumes": [
+    "mesh-controller.doctor-heartbeat"
+  ],
+  "invokes": [
+    "mesh-watcher.watcher_ping",
+    "seat:mesh-controller.seats"
+  ],
+  "own-secrets": {
+    "telegram-token": "${dir:state}/telegram-token"
+  },
+  "tools": [
+    "watcher_status",
+    "watcher_last_heard",
+    "watcher_test",
+    "watcher_ping"
+  ],
+  "resources": [
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "settings",
+      "type": "file",
+      "path": "${dir:state}/settings.json",
+      "mode": "0600",
+      "merge": "json",
+      "content": "{\n  \"telegram-chat-id\": \"\"\n}\n"
+    }
+  ],
+  "build": {
+    "artifacts": [
+      {
+        "name": "tools",
+        "kind": "bundle",
+        "language": "go",
+        "system": "arch",
+        "from": "cmd/mesh-watcher",
+        "binary": "mesh-watcher",
+        "loads": [
+          "mesh-watcher"
+        ],
+        "env": {
+          "MESH_WATCHER_SETTINGS": "${dir:state}/settings.json",
+          "MESH_WATCHER_TELEGRAM_TOKEN_FILE": "${dir:state}/telegram-token"
+        }
+      }
+    ]
+  }
+}