Merge pull request 'mesh-knowledge: run watch as the account the health tool reads as (hq issue 479)' (#209) from fix/479-the-watch-verdict-is-readable into main

modules/mesh-knowledge/cmd/mesh-knowledge/manifest_test.go

@@ -124,6 +124,12 @@ func TestItsProcessesAreThePreparationTheActAndTheJudge(t *testing.T) {
 	if watch["env"].(map[string]any)["MESH_KNOWLEDGE_STATUS"] != m.Build.Artifacts[0].Env["MESH_KNOWLEDGE_STATUS"] {
 		t.Fatal("watch writes another status file than the health tool reads")
 	}
+	// The health tool reads the status file as the account the runtime runs the bundle as, and the mesh gives that
+	// account the state directory (and nothing a process writes there later). A watch running as root wrote the
+	// file root's, 0600, and the tool could not open it (hq issue 479): watch runs as that account, as zfs's does.
+	if watch["user"] != "${machine:account}" {
+		t.Fatalf("watch runs as %v, not as the account the health tool reads its verdict as", watch["user"])
+	}
 	settings := byID["settings"]
 	var s Settings
 	if err := json.Unmarshal([]byte(settings["content"].(string)), &s); err != nil || s.JudgeModel == "" || s.ReservedFor != "168h" {