The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

48 definitions stop naming /var/lib/mesh/<module>: the directory says `place: "mesh"`, the two
subdirectories beneath it (gitea's runtime state, anthropic-manager's output) state their path
beneath it, and every credential, binding, merged file and mount names it as ${dir:mesh-state}.
Resolved on the default root, every definition names exactly the paths it named before —
TestPlacedDirectoriesKeepTheirPaths in mesh-controller, run over both checkouts. Needs the
controller that knows the word (mesh-controller, same branch) one release ahead.

modules/step-ca/module.json

@@ -34,14 +34,14 @@
     }
   ],
   "own-secrets": {
-    "password": "/var/lib/mesh/step-ca/password"
+    "password": "${dir:mesh-state}/password"
   },
   "resources": [
     {
       "id": "mesh-state",
       "type": "directory",
-      "path": "/var/lib/mesh/step-ca",
-      "mode": "0700"
+      "mode": "0700",
+      "place": "mesh"
     },
     {
       "id": "home",
@@ -53,7 +53,7 @@
     {
       "id": "config",
       "type": "file",
-      "path": "/var/lib/mesh/step-ca/config.json",
+      "path": "${dir:mesh-state}/config.json",
       "mode": "0644",
       "content": "{}",
       "merge": "json"
@@ -61,7 +61,7 @@
     {
       "id": "init-env",
       "type": "file",
-      "path": "/var/lib/mesh/step-ca/init.env",
+      "path": "${dir:mesh-state}/init.env",
       "mode": "0600",
       "content": "DOCKER_STEPCA_INIT_PASSWORD=${secret:password}\nDOCKER_STEPCA_INIT_DNS_NAMES=${machine:at},${machine:name},localhost,127.0.0.1\n"
     },
@@ -72,7 +72,7 @@
       "image": "smallstep/step-ca@sha256:a2b17872915c193259b75a5474c398326f41bd199f0842093e52cf4182bc8270",
       "network": "host",
       "env-file": [
-        "/var/lib/mesh/step-ca/init.env"
+        "${dir:mesh-state}/init.env"
       ],
       "env": {
         "DOCKER_STEPCA_INIT_NAME": "Mesh Internal CA",
@@ -81,7 +81,7 @@
       },
       "volumes": [
         "${dir:home}:/home/step",
-        "/var/lib/mesh/step-ca:/run/mesh:ro"
+        "${dir:mesh-state}:/run/mesh:ro"
       ],
       "secrets-in-environment": "the entrypoint honours DOCKER_STEPCA_INIT_PASSWORD_FILE; convertible, awaiting a bed that proves it"
     }