claude-code: point the agent at the mesh's tools and guard its shell against ssh to the mesh (hq ADR 0245)

The agent kept running ssh <machine> journalctl while the journal verb existed. The managed
instructions now carry an "instead of" table generated from what each verb says it replaces, and
the plugin carries a PreToolUse guard that refuses ssh to a mesh machine and local work-arounds for a
mesh name, naming the tool or saying one must be created. The operator's override is read from the
session's start environment and recorded.

modules/claude-code/cmd/claude-code/node.go

@@ -127,8 +127,12 @@ func RenderNow(p Paths, write WriteManaged) ([]string, error) {
 	var items map[string]Item
 	_ = readJSON(p.config(), &items)
 	config := ConfigOf(items)
-	files := Render(facts, settings, binding, p.helper(), Registered(p), config)
-	tree, _ := json.Marshal(Marketplace(config))
+	mesh := ReadMeshTools(p)
+	if mesh != nil {
+		mesh.Refused = RefusedCounts(GuardDataOf(p, mesh).Log)
+	}
+	files := RenderWithMesh(facts, settings, binding, p.helper(), Registered(p), config, mesh)
+	tree, _ := json.Marshal(MarketplaceWith(config, guardFiles(p, mesh)))
 	files[MarketplaceDir+"/"] = string(tree)
 	names := make([]string, 0, len(files))
 	for n := range files {