Read the vault's credential forms from mesh-sdk's one list, as the provisioner client does (issue 774)

pair.go kept its own copy of the forms a plan may name; the copy in the provisioner client went in #564, after it
refused plans naming `none` while the vault's copy took them. Quick fix and thorough fix are the same here: the vault's
constants are mesh-sdk's (catalogue.CredentialForm*), and a form is judged by catalogue.IsCredentialForm, so a new
form is added in one place. No new test: behaviour is unchanged, and the existing form tests pass on the shared list.
mesh-vault's mesh-sdk pin moves to 9379e9a9, the provisioner client's, the first with the list.

modules/mesh-vault/cmd/mesh-vault/pair.go

@@ -55,6 +55,7 @@ import (
 	"strings"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"git.novox.be/novox/mesh-sdk/go/seal"
 )
 
@@ -145,23 +146,21 @@ type binds struct {
 	tools   map[string]bool
 }
 
-// The credential forms a plan entry names (issue 768), as the provider's offer declares them.
+// The credential forms a plan entry names (issue 768), as the provider's offer declares them: mesh-sdk's one list
+// (catalogue.CredentialForms, issue 774), which the provisioner client reads too, so the two cannot drift.
 const (
 	// FormShared is one value every holder shares (ADR 0158): the offer's credential is one of its own secrets.
-	FormShared = "shared"
+	FormShared = catalogue.CredentialFormShared
 	// FormPair is a login of its own for each consumer (ADR 0048, ADR 0158 §11): the offer says no credential.
-	FormPair = "pair"
+	FormPair = catalogue.CredentialFormPair
 	// FormIssued is a value the provider's software issues (ADR 0305): the mesh never makes it.
-	FormIssued = "issued"
+	FormIssued = catalogue.CredentialFormIssued
 	// FormGiven is a value only a person gives (ADR 0337): the mesh never makes it.
-	FormGiven = "given"
+	FormGiven = catalogue.CredentialFormGiven
 	// FormNone is an offer whose consumers present no credential: the vault mints nothing for it.
-	FormNone = "none"
+	FormNone = catalogue.CredentialFormNone
 )
 
-// credentialForms are every form a plan entry may name.
-var credentialForms = []string{FormShared, FormPair, FormIssued, FormGiven, FormNone}
-
 // form is the one form the plans name for k, or why the vault cannot trust one.
 func (b *binds) form(k pairKey) (string, string) {
 	if b == nil || len(b.forms) == 0 || b.forms[""] {
@@ -169,9 +168,9 @@ func (b *binds) form(k pairKey) (string, string) {
 	}
 	var named []string
 	for f := range b.forms {
-		if !slices.Contains(credentialForms, f) {
+		if !catalogue.IsCredentialForm(f) {
 			return "", fmt.Sprintf("a plan names %q for %s from %s, which is not a credential form the vault knows "+
-				"(%s); it makes nothing", f, k.provision, k.provider, strings.Join(credentialForms, ", "))
+				"(%s); it makes nothing", f, k.provision, k.provider, strings.Join(catalogue.CredentialForms(), ", "))
 		}
 		named = append(named, f)
 	}

modules/mesh-vault/go.mod

@@ -3,7 +3,7 @@ module mesh-vault
 go 1.26.0
 
 require (
-	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0
+	git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030150314-9379e9a96ad4
 	github.com/nats-io/nats-server/v2 v2.11.17
 	github.com/nats-io/nats.go v1.54.0
 	golang.org/x/crypto v0.57.0

modules/mesh-vault/go.sum

@@ -1,5 +1,7 @@
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0 h1:lKU3HjNXGiVbLW2hUgFjU/TMTUYMlNnnmZxG5T7biQA=
 git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030001116-2da0de75c3f0/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030150314-9379e9a96ad4 h1:CPUqC3FS/ezvBYdhVgVdsQg2DdN8xgtROQkSaHRKeOI=
+git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261030150314-9379e9a96ad4/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
 github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=