A-72: no @novox/mesh-* package counts as beyond the SDK in mesh-build-node

Builds: design 47 G G-20 A-72

Claude-Session: https://claude.ai/code/session_01NcbgfGKaxw984XyAPfLm4h

modules/mesh-build-node/cmd/mesh-build-node/fetch_test.go

@@ -96,6 +96,20 @@ func TestAModuleNamingOnlyTheSdkAndTypesInstallsNothing(t *testing.T) {
 	}
 }
 
+// 47/G A-72: a module naming another @novox/mesh-* package beside the SDK has no package beyond the SDK, so it installs
+// nothing and is not refused for want of a lock.
+func TestAMeshPackageIsNotBeyondTheSdk(t *testing.T) {
+	m, f := fetchMachine(t, typeScriptModule(`{"dependencies":{"@novox/mesh-sdk":"^0.1.6","@novox/mesh-tools":"^0.1.6"}}`), nil)
+	out, err := m.fetch(context.Background(), fetchArgs)
+	if err != nil {
+		t.Fatal(err)
+	}
+	r := out.(FetchResult)
+	if len(npmCalls(f)) != 0 || len(r.Installed) != 0 || len(r.Refused) != 0 {
+		t.Errorf("result = %+v, npm calls %d, want nothing installed and nothing refused", r, len(npmCalls(f)))
+	}
+}
+
 // 1489/AC2: a module naming lodash with a lock gets npm ci --omit=dev --ignore-scripts (fake runner), its install put
 // at its node_modules without the SDK and without any copy of it; without a lock the step fails naming the directory.
 func TestAModuleNamingLodashWithALockIsInstalledWithoutTheSdkAndWithoutALockFails(t *testing.T) {