mesh-cli: the operator's command on every node, nox in zsh (hq ADR 0272)

The records send the operator to "the controller's terminal", and on the
control-node nothing answered (hq issue 343). mesh-cli is a module of its
own, assigned to every node and built from its own directory: its program
is unpacked into /usr/local/bin by an archive resource (one file, no link,
no copy), and its zsh contribution makes nox its alias. It holds no
credential: it asks the node-engine on its machine over the SDK's go/cli
socket, and prints the controller's answer with its exit.

The agent module's refusals and README, and the route adapter's README, now
name `mesh-cli settings set …` on the control-node instead of a
mesh-controller command nobody could type; a settings file is passed inline,
since a path would be read where the controller runs.

modules/claude-code/cmd/claude-code/config.go

@@ -86,8 +86,8 @@ var nodeName = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{0,62}$`)
 
 // AtTheTerminal is how a hook, a permission rule or any other managed setting is set now (novox/hq issue 340):
 // in this module's `managed_settings` setting, at the controller's terminal, which refuses it through a verb.
-const AtTheTerminal = "mesh-controller settings set claude-code '{\"managed_settings\": {...}}' [--node <node>], " +
-	"typed by the operator at the controller's terminal"
+const AtTheTerminal = "mesh-cli settings set claude-code '{\"managed_settings\": {...}}' [--node <node>], " +
+	"typed by the operator at the controller's terminal: mesh-cli (nox) on the control-node (novox/hq ADR 0272)"
 
 // RunsInASession says why a kind is never registered through this module: what it holds runs in, or is obeyed
 // by, every session it reaches, as whoever starts that session (novox/hq issue 340).
@@ -935,7 +935,7 @@ func SharedTextAtTheTerminal(kind string) string {
 		KindOutputStyle: "output_styles", KindInstructions: "instructions"}[kind]
 	return "a " + kind + " for every node or some reaches every session there as the mesh's own word, and this tool " +
 		"cannot tell an agent from the operator. It is set at the controller's terminal only, under `" + key +
-		"` in this module's settings, its text as a list of lines: mesh-controller settings set claude-code " +
+		"` in this module's settings, its text as a list of lines, on the control-node: mesh-cli settings set claude-code " +
 		"'{\"" + key + "\": {\"<name>\": [\"line\", …]}}' [--node <node>] (novox/hq issue 340). The home scope, " +
 		"one account's own directory, is still registered here. Nothing was registered"
 }

modules/claude-code/cmd/claude-code/node.go

@@ -604,7 +604,7 @@ func OnServerChange(v *ServerView, c ServerChange, p Paths, write WriteManaged)
 const ServerAtTheTerminal = "a tool server is started, or handed what the agent asks it, by every session on the nodes it " +
 	"reaches, as whoever starts that session — the operator, whose account holds root — and the tool runner is not " +
 	"told who called it, so an agent on another node could register one. It is set at the controller's terminal " +
-	"only, in this module's mcp_servers setting: mesh-controller settings set claude-code '{\"mcp_servers\": {...}}' " +
+	"only, in this module's mcp_servers setting, on the control-node: mesh-cli settings set claude-code '{\"mcp_servers\": {...}}' " +
 	"[--node <node>] (novox/hq issue 340). Nothing was registered"
 
 // RegisterServer unregisters a server: a delete per scope in the `servers` state, taken into this node's view at

modules/claude-code/cmd/claude-code/terminal_only_test.go

@@ -130,7 +130,7 @@ func TestWhatASessionRunsIsRefusedThroughEveryTool(t *testing.T) {
 
 	// The settings and the tool server refusals name the terminal's line.
 	text, _ := s.call(t, "claude_code_settings_set", map[string]any{"settings": map[string]any{"model": "x"}})
-	if !strings.Contains(text, "mesh-controller settings set claude-code") {
+	if !strings.Contains(text, "mesh-cli settings set claude-code") {
 		t.Errorf("the refusal does not say how it is done: %s", text)
 	}
 	text, _ = s.call(t, "claude_code_mcp_register", map[string]any{"name": "x", "url": "https://x.example"})