betterbird: withhold account values in the user.js answer, never write a shared outgoing server, and say a newer Owl as a fact (review 34, hq issue 345, ADR 0317)

The user.js answer carried declared addresses and hosts (ADR 0316 §16). An
adopted identity's outgoing server may be shared with an account the module
does not own, whose sending the declared values would change at every start:
refused with the remedy, since ADR 0317 §2 leaves the identity's server and
the lists as they are; a recorded adoption follows the identity's current
server. Owl installed by policy cannot be removed, so a newer Owl than the
pin is a fact whose remedy is moving the pin.

modules/betterbird/README.md

@@ -54,8 +54,9 @@ reading the new range there (ADR 0316 §8).
 **The policy** turns Betterbird's own updater off (`DisableAppUpdate`, which Betterbird's update check
 honours) and installs Owl into every profile from `file:///opt/betterbird/owl/owl.xpi` as
 `force_installed`, with `updates_disabled`. A profile that already runs another Owl keeps it: the policy
-installs the pinned one where Owl is missing, and `betterbird_check` says when the profile's Owl is not
-the pin. **Owl's licence stays the person's**: the mesh holds no licence, key or payment (ADR 0316 §9).
+installs the pinned one where Owl is missing. A newer Owl in the profile (g14 runs 1.5.7) is said as a
+fact by `betterbird_status`; Owl installed by policy cannot be removed in Betterbird, so the remedy is
+moving the pin. An older one is a finding of `betterbird_check`, with the same remedy. **Owl's licence stays the person's**: the mesh holds no licence, key or payment (ADR 0316 §9).
 
 **No start of its own.** Betterbird is started by the operator from the launcher. The start
 (`/usr/local/bin/betterbird`) first runs `betterbird-tools prepare`, which, with no Betterbird of the
@@ -120,7 +121,12 @@ declared account, in its place in the setting, is (ADR 0317 §1):
 **Refused, for that account alone and with the remedy** (§7): two accounts with the address (remove the
 duplicate in Betterbird, or name the `key`), Owl's account at the address, a named key that does not
 qualify, an account of another kind than declared (never converted), an identity that names no outgoing
-server. The other accounts go ahead; the start and `betterbird_check` say it.
+server, and an outgoing server that another identity, neither adopted nor the module's, also uses
+(Betterbird lets identities share one, and the declared values would change that other account's sending;
+ADR 0317 §2 leaves the identity's server and the lists as they are, so the module refuses rather than give
+it a server of its own). A recorded adoption follows the identity's current outgoing server at every apply,
+under the same rule. The other accounts go ahead; the start and `betterbird_check` say it.
+`betterbird_user_js` answers an account's preferences by name with their values withheld.
 
 The declared fields are written in the user.js under the account's keys, so they win at every start; only
 the fields the setting names, never the account's directory, folders, filters, caches, mail or kept