Let mounts write each share's mount and automount, so no node depends on a hand-written fstab line (hq ADR 0263)

A machine mounts what its assignment names: a node's share from the
provision nfs-share, whose path it reads from nfs-server's state on the
bus, and occasional sources (an SMB device, a disk) whose absence is a
state, not a fault. apply writes and arms the unit pairs as root; watch
tries each source and judges the health; the operator's fstab lines are
taken over only through adopt, on their word, once the replacement is
armed. SMB logins are an outside party's secret, given with secret accept.

modules/mounts/module.json

@@ -1,9 +1,133 @@
 {
   "module": "mounts",
   "version": "1",
+  "requires": [
+    "nfs-share"
+  ],
+  "reads": [
+    "nfs-server.exports"
+  ],
+  "capabilities": [
+    "package-manager",
+    "service-manager"
+  ],
+  "claims": [
+    {
+      "name": "node-mounts",
+      "scope": "node",
+      "serves": [
+        "list",
+        "test",
+        "mount",
+        "unmount",
+        "adopt"
+      ]
+    }
+  ],
   "tools": [
     "mounts_list",
-    "mounts_exports"
+    "mounts_exports",
+    "mounts_health"
+  ],
+  "state": [
+    {
+      "name": "shares",
+      "per-machine": true
+    }
+  ],
+  "settings": {
+    "shares": {
+      "kind": "preference",
+      "default": "none",
+      "why": "a machine mounts no share of another until its assignment names one: space-separated name=mountpoint, each optionally :ro (hq ADR 0263 rule 5)"
+    },
+    "sources": {
+      "kind": "preference",
+      "default": "none",
+      "why": "a machine has no occasional source until its assignment names one: space-separated name=smb://<host>/<share>@<mountpoint> or name=disk:<uuid>@<mountpoint>, each optionally :ro (hq ADR 0263 rule 6)"
+    }
+  },
+  "own-secrets": {
+    "smb-credentials": {
+      "path": "${dir:state}/smb-credentials.secret",
+      "taken": "at-start",
+      "issued-by": "outside"
+    }
+  },
+  "resources": [
+    {
+      "id": "nfs-utils",
+      "type": "package",
+      "package": "nfs-utils"
+    },
+    {
+      "id": "cifs-utils",
+      "type": "package",
+      "package": "cifs-utils"
+    },
+    {
+      "id": "state",
+      "type": "directory",
+      "mode": "0700",
+      "place": "."
+    },
+    {
+      "id": "config-dir",
+      "type": "directory",
+      "path": "/etc/mesh-mounts",
+      "mode": "0755"
+    },
+    {
+      "id": "config",
+      "type": "file",
+      "path": "/etc/mesh-mounts/mounts.conf",
+      "mode": "0644",
+      "content": "# Written by the mesh (module mounts, novox/hq ADR 0263) from this machine's assignment: the settings\n# shares and sources, and the binding of nfs-share. Replaced on every push; change the settings, not this.\n# The module's process reads it as root every 30 seconds and writes one .mount and .automount per entry.\nshares=${setting:shares}\nsources=${setting:sources}\nserver=${bound:nfs-share:from}\nat=${bound:nfs-share:at}\naccount=${machine:account}\nsecret=${dir:state}/smb-credentials.secret\nstate=${dir:state}\n"
+    },
+    {
+      "id": "bus-dir-parent",
+      "type": "directory",
+      "path": "/var/lib/mesh-mounts",
+      "mode": "0755"
+    },
+    {
+      "id": "bus-dir",
+      "type": "directory",
+      "path": "/var/lib/mesh-mounts/from-bus",
+      "mode": "0755",
+      "owner": "${machine:account}"
+    },
+    {
+      "id": "apply",
+      "type": "process",
+      "name": "mesh-mounts-apply",
+      "artifact": "tools-go",
+      "run": [
+        "./mounts",
+        "apply"
+      ],
+      "health": {
+        "kind": "unit"
+      }
+    },
+    {
+      "id": "watch",
+      "type": "process",
+      "name": "mesh-mounts-watch",
+      "artifact": "tools-go",
+      "run": [
+        "./mounts",
+        "watch"
+      ],
+      "health": {
+        "kind": "tool",
+        "tool": "mounts_health",
+        "interval": "60s",
+        "timeout": "10s",
+        "looks": 2,
+        "grace": "90s"
+      }
+    }
   ],
   "build": {
     "artifacts": [