Run telegram as its own account in a runtime of its own, keep its offset per update, and keep no copy of a secret on the desk (hq ADR 0259 §8)

modules/telegram/module.json

@@ -2,6 +2,7 @@
   "module": "telegram",
   "version": "1",
   "slug": "tgrm",
+  "runs-as": "telegram",
   "claims": [
     {
       "name": "channel",
@@ -33,6 +34,7 @@
     }
   ],
   "own-secrets": {
+    "broker": "${dir:state}/broker",
     "telegram-token": "${dir:state}/telegram-token"
   },
   "secrets-owner": "telegram",
@@ -68,7 +70,6 @@
           "telegram"
         ],
         "env": {
-          "MESH_RUN_AS": "telegram",
           "MESH_TELEGRAM_TOKEN_FILE": "${dir:state}/telegram-token"
         }
       }