Say on every directory how it treats files it does not know, and check it (issue 1024, ADR 0422)

Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.

modules/betterbird/README.md

@@ -347,3 +347,14 @@ outside the mesh. With this version, a push to a node (each waits for the operat
 - The controller's `settings` verb, for every proposal and to read a layer as it stands; its `nodes` and `node`
   verbs, for which machines hold the module; and the module's own `betterbird_derive` on those machines
   (`invokes`).
+
+## Files it does not know
+
+Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
+
+- `~/.config/betterbird`: holds only what this module declares and its own tools' records: `accounts-record.json` (`cmd/betterbird-tools/adoption.go:36`), `configuration-record.json` (`owned.go:33`) and the `kept/` folder of replaced filter files (`filters.go:261`); anything else is moved out by the node-engine to `~/.local/state/mesh-moved/betterbird/` with a list, never deleted (ADR 0422 §4).
+- `/opt/betterbird`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `/opt/betterbird/owl`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `/opt/betterbird/distribution`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `/opt/betterbird/defaults/pref`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
+- `/usr/local/lib/mesh-betterbird`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).

modules/betterbird/module.json

@@ -83,7 +83,9 @@
       "type": "directory",
       "path": "${machine:account-home}/.config/betterbird",
       "owner": "${machine:account}",
-      "mode": "0755"
+      "mode": "0755",
+      "unknown": "move-out",
+      "knows": ["accounts-record.json", "configuration-record.json", "kept/"]
     },
     {
       "id": "prefs",
@@ -150,31 +152,36 @@
       "id": "installation",
       "type": "archive",
       "path": "/opt/betterbird",
-      "artifact": "archive"
+      "artifact": "archive",
+      "unknown": "program"
     },
     {
       "id": "owl",
       "type": "archive",
       "path": "/opt/betterbird/owl",
-      "artifact": "owl"
+      "artifact": "owl",
+      "unknown": "program"
     },
     {
       "id": "policies",
       "type": "archive",
       "path": "/opt/betterbird/distribution",
-      "artifact": "distribution"
+      "artifact": "distribution",
+      "unknown": "program"
     },
     {
       "id": "spelling",
       "type": "archive",
       "path": "/opt/betterbird/defaults/pref",
-      "artifact": "defaults"
+      "artifact": "defaults",
+      "unknown": "program"
     },
     {
       "id": "preparation",
       "type": "archive",
       "path": "/usr/local/lib/mesh-betterbird",
-      "artifact": "tools"
+      "artifact": "tools",
+      "unknown": "program"
     },
     {
       "id": "start",